====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN209
_____________________________________________________________________

DATE                : 17/04/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running AWS SAM Plugin for Jenkins,
                                     Copr Plugin for Jenkins,
                                  Parasoft Findings Plugin for Jenkins,
                                     Yaml Axis Plugin for Jenkins.

=====================================================================
https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1736
_____________________________________________________________________

 Jenkins Security Advisory 2020-04-16

This advisory announces vulnerabilities in the following Jenkins
deliverables:

    AWS SAM Plugin
    Copr Plugin
    Parasoft Findings Plugin
    Yaml Axis Plugin

Descriptions

Credentials stored in plain text by Copr Plugin


SECURITY-1556 / CVE-2020-2177

Copr Plugin 0.3 and earlier stores credentials unencrypted in job
config.xml files as part of its configuration. These credentials can be
viewed by users with Extended Read permission or access to the master
file system.

Copr Plugin 0.6.1 stores these credentials encrypted. This change is
effective once the job configuration is saved the next time.


XXE vulnerability in Parasoft Findings Plugin
SECURITY-1753 / CVE-2020-2178

Parasoft Findings Plugin implements a static analysis parser for various
Parasoft products and integrates with Warnings Plugin (10.4.1 and
earlier) and Warnings NG Plugin (10.4.2 and newer).

Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML
parser to prevent XML external entity (XXE) attacks. This allows a user
able to control the input files for the Parasoft Findings parser to have
Jenkins parse a crafted file that uses external entities for extraction
of secrets from the Jenkins master or server-side request forgery.

Parasoft Findings Plugin 10.4.4 disables external entity resolution for
its XML parser.


RCE vulnerability in Yaml Axis Plugin
SECURITY-1825 / CVE-2020-2179

Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to
prevent the instantiation of arbitrary types. This results in a remote
code execution (RCE) vulnerability exploitable by users able to
configure a multi-configuration (Matrix) job, or control the contents of
a previously configured job’s SCM repository.

Yaml Axis Plugin 0.2.1 configures its YAML parser to only instantiate
safe types.


RCE vulnerability in AWS SAM Plugin
SECURITY-1736 / CVE-2020-2180

AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to
prevent the instantiation of arbitrary types. This results in a remote
code execution (RCE) vulnerability exploitable by users able to
configure a job or control the contents of a previously configured "AWS
SAM deploy application" build step’s YAML SAM template file
(template.yaml or equivalent) file.

AWS SAM Plugin 1.2.3 configures its YAML parser to only instantiate safe
types.


Severity

    SECURITY-1556: Medium
    SECURITY-1736: High
    SECURITY-1753: High
    SECURITY-1825: High

Affected Versions

    AWS SAM Plugin up to and including 1.2.2
    Copr Plugin up to and including 0.3
    Parasoft Findings Plugin up to and including 10.4.3
    Yaml Axis Plugin up to and including 0.2.0

Fix

    AWS SAM Plugin should be updated to version 1.2.3
    Copr Plugin should be updated to version 0.6.1
    Parasoft Findings Plugin should be updated to version 10.4.4
    Yaml Axis Plugin should be updated to version 0.2.1

These versions include fixes to the vulnerabilities described above. All
prior versions are considered to be affected by these vulnerabilities
unless otherwise indicated.


Credit

The Jenkins project would like to thank the reporters for discovering
and reporting these vulnerabilities:

    Federico Pellegrin for SECURITY-1753
    James Holderness, IB Boost for SECURITY-1556

=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================