Bug 1471050 - (CVE-2017-1000089) CVE-2017-1000089 jenkins-plugin-pipeline-build-step: Missing check of Item/Build permission (SECURITY-433)
CVE-2017-1000089 jenkins-plugin-pipeline-build-step: Missing check of Item/Bu...
Status: CLOSED WONTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20170710,reported=2...
: Security
Depends On: 1472030
Blocks: 1471067
  Show dependency treegraph
 
Reported: 2017-07-14 06:12 EDT by Adam Mariš
Modified: 2017-08-18 01:25 EDT (History)
9 users (show)

See Also:
Fixed In Version: jenkins-plugin-pipeline-build-step 2.5.1
Doc Type: If docs needed, set a value
Doc Text:
The jenkins-plugin-pipeline-build-step fails to check permissions correctly allowing attackers with access to it to specify the triggering of any other project in Jenkins. This potentially gives an attacker access to projects they should not have access to.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-08-14 12:43:12 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Adam Mariš 2017-07-14 06:12:03 EDT
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. By default, builds run as SYSTEM and are unconstrained unless plugins implement specific additional permission checks.

Plugins like Authorize Project Plugin allow changing the authentication associated with a build.

The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.

External References:

https://jenkins.io/security/advisory/2017-07-10/
Comment 1 Adam Mariš 2017-07-14 06:12:20 EDT
Acknowledgments:

Name: the Jenkins project
Comment 3 Trevor Jay 2017-08-14 12:43:12 EDT
Statement:

This issue affects the versions of jenkins-plugin-pipeline-build-step as shipped with Red Hat OpenShift Enterprise 3. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Note You need to log in before you can comment on or make changes to this bug.