Arch Linux Security Advisory ASA-201807-14
==========================================

Severity: High
Date    : 2018-07-21
CVE-ID  : CVE-2018-1999001 CVE-2018-1999002 CVE-2018-1999003 CVE-2018-1999004
          CVE-2018-1999005 CVE-2018-1999006 CVE-2018-1999007
Package : jenkins
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-738

Summary
=======

The package jenkins before version 2.133-1 is vulnerable to multiple
issues including access restriction bypass, arbitrary filesystem
access, cross-site scripting and information disclosure.

Resolution
==========

Upgrade to 2.133-1.

# pacman -Syu "jenkins>=2.133-1"

The problems have been fixed upstream in version 2.133.

Workaround
==========

None.

Description
===========

- CVE-2018-1999001 (access restriction bypass)

Unauthenticated users could provide maliciously crafted login
credentials that cause Jenkins before 2.133 to move the config.xml file
from the Jenkins home directory. This configuration file contains basic
configuration of Jenkins, including the selected security realm and
authorization strategy. If Jenkins is started without this file
present, it will revert to the legacy defaults of granting
administrator access to anonymous users. This issue was caused by the
fix for SECURITY-499 in the 2017-11-08 security advisory.

- CVE-2018-1999002 (arbitrary filesystem access)

An arbitrary file read vulnerability in the Stapler web framework used
by Jenkins before 2.133 allowed unauthenticated users to send crafted
HTTP requests returning the contents of any file on the Jenkins master
file system that the Jenkins master process has access to.

- CVE-2018-1999003 (access restriction bypass)

The URLs handling cancellation of queued builds in Jenkins before 2.133
did not perform a permission check, allowing users with Overall/Read
permission to cancel queued builds.

- CVE-2018-1999004 (access restriction bypass)

The URL that initiates agent launches on the Jenkins master before
2.133 did not perform a permission check, allowing users with
Overall/Read permission to initiate agent launches.
Doing so canceled all ongoing launches for the specified agent, so this
allowed attackers to prevent an agent from launching indefinitely.

- CVE-2018-1999005 (cross-site scripting)

The build timeline widget shown on URLs like /view/…/builds in Jenkins
before 2.133 did not properly escape display names of items. This
resulted in a cross-site scripting vulnerability exploitable by users
able to control item display names

- CVE-2018-1999006 (information disclosure)

Files indicating when a plugin JPI file was last extracted into a
subdirectory of plugins/ in the Jenkins home directory were accessible
via HTTP by users with Overall/Read permission before Jenkins 2.133.
This allowed unauthorized users to determine the likely install date of
a given plugin.

- CVE-2018-1999007 (cross-site scripting)

Stapler is the web framework used by Jenkins to route HTTP requests.
When its debug mode is enabled, HTTP 404 error pages display diagnostic
information. Those error pages did not escape parts of URLs they
displayed before Jenkins 2.133, in rare cases resulting in a cross-site
scripting vulnerability.

Impact
======

A remote attacker is able to bypass access restrictions to gain
administrative privileges, access arbitrary files, disclose information
or perform cross-site scripting.

References
==========

https://jenkins.io/security/advisory/2018-07-18/
https://security.archlinux.org/CVE-2018-1999001
https://security.archlinux.org/CVE-2018-1999002
https://security.archlinux.org/CVE-2018-1999003
https://security.archlinux.org/CVE-2018-1999004
https://security.archlinux.org/CVE-2018-1999005
https://security.archlinux.org/CVE-2018-1999006
https://security.archlinux.org/CVE-2018-1999007