Jenkins
Jenkins Security Advisory 2019-03-06
2019-03-06 Mar 6, 2019 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2019-03-06/. 13 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2019-03-06/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
8 lines
Showing 1–8 of 8
Acknowledgement
BR2019-0000-020094
SECURITY-970
unclaimed
Missing permission check allowed connecting to RabbitMQ in Rabbit-MQ Publisher Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2019-1003037
BR2019-0000-020095
SECURITY-1332
unclaimed
Unprivileged users with Overall/Read access are able to enumerate credential IDs in Azure VM Agents Plugin
Credited as Daniel Beck, CloudBees, Inc.
Acknowledgement
BR2019-0000-020096
SECURITY-1336
unclaimed
SECURITY-1336
Credited as Georgy Noseevich (@webpentest), SolidLab
CVE-2019-1003035
BR2019-0000-020097
SECURITY-1330
unclaimed
Information disclosure in Azure VM Agents Plugin
Credited as Oleg Nenashev, CloudBees, Inc.
CVE-2019-1003036
BR2019-0000-020098
SECURITY-1331
unclaimed
Missing permission check in Azure VM Agents Plugin allowed modifying VM configuration
Credited as Oleg Nenashev, CloudBees, Inc.
Acknowledgement
BR2019-0000-020099
SECURITY-848
unclaimed
Rabbit-MQ Publisher Plugin stored password in plain text
Credited as Viktor Gazdag
CVE-2019-1003038
BR2019-0000-020100
SECURITY-958
unclaimed
Repository Connector Plugin stored password in plain text
Credited as Viktor Gazdag
CVE-2019-1003039
BR2019-0000-020101
SECURITY-1087
unclaimed
AppDynamics Dashboard Plugin stored password in plain text
Credited as Viktor Gazdag