Publish Advisories

GHSA-6h72-m3xw-fp3c
GHSA-m68x-cc2f-gr5h
GHSA-mhwq-4mh7-fv7c

advisories/github-reviewed/2022/05/GHSA-6h72-m3xw-fp3c/GHSA-6h72-m3xw-fp3c.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6h72-m3xw-fp3c",
-  "modified": "2022-05-13T01:40:56Z",
+  "modified": "2024-01-30T22:44:21Z",
   "published": "2022-05-13T01:40:56Z",
   "aliases": [
     "CVE-2017-1000104"
   ],
+  "summary": "Improper Privilege Management in Jenkins Config File Provider Plugin",
   "details": "The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overall/Read access to Jenkins were able to access URLs directly that allowed viewing these files. Access to view these files now requires sufficient permissions to configure the provided files, view the configuration of the folder in which the configuration files are defined, or have Job/Configure permissions to a job able to use these files.",
   "severity": [
     {
@@ -14,7 +15,28 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:config-file-provider"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.16.2"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 2.16.1"
+      }
+    }
   ],
   "references": [
     {
@@ -31,8 +53,8 @@
       "CWE-269"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T22:44:21Z",
     "nvd_published_at": "2017-10-05T01:29:00Z"
   }
 }

advisories/github-reviewed/2022/05/GHSA-m68x-cc2f-gr5h/GHSA-m68x-cc2f-gr5h.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m68x-cc2f-gr5h",
-  "modified": "2022-05-13T01:40:54Z",
+  "modified": "2024-01-30T22:46:07Z",
   "published": "2022-05-13T01:40:54Z",
   "aliases": [
     "CVE-2017-1000095"
   ],
+  "summary": "Unsafe methods in the default list of approved signatures in Jenkins Script Security Plugin",
   "details": "The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).",
   "severity": [
     {
@@ -14,7 +15,28 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:script-security"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.29.1"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 1.29"
+      }
+    }
   ],
   "references": [
     {
@@ -31,8 +53,8 @@
       "CWE-732"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T22:46:07Z",
     "nvd_published_at": "2017-10-05T01:29:00Z"
   }
 }

advisories/github-reviewed/2022/05/GHSA-mhwq-4mh7-fv7c/GHSA-mhwq-4mh7-fv7c.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mhwq-4mh7-fv7c",
-  "modified": "2022-05-13T01:40:55Z",
+  "modified": "2024-01-30T22:45:53Z",
   "published": "2022-05-13T01:40:55Z",
   "aliases": [
     "CVE-2017-1000096"
   ],
+  "summary": "Arbitrary code execution due to incomplete sandbox protection in Jenkins Pipeline",
   "details": "Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.",
   "severity": [
     {
@@ -14,7 +15,28 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins.workflow:workflow-cps"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.36.1"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 2.36"
+      }
+    }
   ],
   "references": [
     {
@@ -35,8 +57,8 @@
       "CWE-732"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T22:45:53Z",
     "nvd_published_at": "2017-10-05T01:29:00Z"
   }
 }