Bug 1471053 (CVE-2017-1000092)

Summary:	CVE-2017-1000092 jenkins-plugin-git: CSRF vulnerability allows capturing credentials (SECURITY-528)
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ahardin, bleanhar, ccoleman, dedgar, dmcphers, eparis, jgoulding, jkeck, joelsmith, jokerman, kseifried, mchappel, tjay
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	jenkins-plugin-git 3.3.2, jenkins-plugin-git 3.4.0-beta-2	Doc Type:	If docs needed, set a value
Doc Text:	The Git Plugin can leak credentials (username and password) used to access a git repo if an attacker-supplied URL is provided to the plugin. To supply the URL to the plugin, the attacker would need to guess a username/password ID and then trick a developer into following a specific URL.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-14 16:43:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1472031
Bug Blocks:	1471067

Description Adam Mariš 2017-07-14 10:17:40 UTC

Git Plugin connects to a user-specified Git repository as part of form validation.

An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.

External References:

https://jenkins.io/security/advisory/2017-07-10/

Comment 1 Adam Mariš 2017-07-14 10:17:56 UTC

Acknowledgments:

Name: the Jenkins project
Upstream: Jesse Glick (CloudBees)

Comment 3 Trevor Jay 2017-08-14 16:43:10 UTC

Statement:

This issue affects the versions of jenkins-plugin-git as shipped with Red Hat OpenShift Enterprise 3. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.