Bug 2044466 (CVE-2022-20618)

Summary:	CVE-2022-20618 jenkins-2-plugins/cloudbees-bitbucket-branch-source: missing permission check allow ID enumeration
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abenaiss, adam.kaplan, aos-bugs, bmontgom, eparis, jburrell, jokerman, nstielau, spandura, sponnaga, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cloudbees-bitbucket-branch-source 746.v350d2781c184	Doc Type:	If docs needed, set a value
Doc Text:	A missing permissions check vulnerability was found in the Jenkins Bitbucket Branch Source plugin in several HTTP endpoints. This flaw allows attackers with Overall/Read access to enumerate IDs of credentials stored in Jenkins.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2044952, 2047839
Bug Blocks:	2044461

Description Michael Kaplan 2022-01-24 16:53:11 UTC

A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.

Reference:

https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2033

Comment 2 Adam Kaplan 2022-01-26 21:04:23 UTC

There are a few layers of transitive dependencies here which need to be updated:

- blueocean depends on blueocean-bitbucket-pipeline:1.24.8
- blueocean-bitbucket-pipeline depends on ... cloudbees-bitbucket-branch-source:2.4.4

Ideally blueocean cuts a new parent plugin and we can just pull the fix in.