====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN383
_____________________________________________________________________

DATE                : 07/12/2017

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running EC2 Plugin for Jenkins versions
                                     prior to 1.38.

=====================================================================
https://jenkins.io/security/advisory/2017-12-06/
_____________________________________________________________________

Jenkins Security Advisory 2017-12-06
This advisory announces a vulnerability in this Jenkins plugin:


EC2

Description
Arbitrary shell command execution on master by users with Agent-related
permissions in EC2 Plugin


SECURITY-643

Users with permission to create or configure agents in Jenkins could
configure an EC2 agent to run arbitrary shell commands on the master
node whenever the agent was supposed to be launched.

Configuration of these agents now requires the Run Scripts permission
typically only granted to administrators.


Severity

SECURITY-643: high


Affected versions

EC2 Plugin up to and including 1.37


Fix

EC2 Plugin should be updated to version 1.38
These versions include fixes to the vulnerabilities described above.
All prior versions are considered to be affected by these
vulnerabilities unless otherwise indicated.


Credit

The Jenkins project would like to thank the reporter for discovering
and reporting this vulnerability:

Jesse Glick, CloudBees Inc. for SECURITY-643

==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================