Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Amazon EC2 Plugin connects to Windows agents via HTTPS. Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed HTTPS certificates and does not perform hostname validation when connecting to Windows agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. Amazon EC2 Plugin 1.50.2 by default no longer accepts self-signed HTTPS certificates and performs hostname validation. A new configuration option allows restoring the previous, unsafe behavior. For more information see the plugin documentation.
Recommended action: Upgrade to 1.50.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Amazon EC2 Plugin provides a list of applicable credentials IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions in Amazon EC2 Plugin 1.50.1 and earlier, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those can be used as part of an attack to capture the credentials using another vulnerability. An enumeration of credentials IDs in Amazon EC2 Plugin 1.50.2 now requires Overall/Administer permission.
Recommended action: Upgrade to 1.50.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not use SSH host key validation when connecting to agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. Jenkins Amazon EC2 Plugin 1.50.2 provides strategies for performing host key validation for administrators to select the one that meets their security needs. It includes assistance for administrators to migrate to a new, more secure strategy. For more information see the plugin documentation.
Recommended action: Upgrade to 1.50.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Amazon EC2 Plugin 1.50.1 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows an attacker to provision instances with an attacker-specified template ID. Amazon EC2 Plugin 1.50.2 now requires POST requests for the affected HTTP endpoints.
Recommended action: Upgrade to 1.50.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Amazon EC2 Plugin 1.47 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method. This vulnerability might also allow attackers to capture credentials stored in Jenkins. We have not been able to confirm that this is possible. Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability. Amazon EC2 Plugin 1.48 requires POST requests and Overall/Administer permission for the affected form validation methods.
Recommended action: Upgrade to 1.48 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Amazon EC2 Plugin 1.47 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method. This vulnerability might also allow attackers to capture credentials stored in Jenkins. We have not been able to confirm that this is possible. Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability. Amazon EC2 Plugin 1.48 requires POST requests and Overall/Administer permission for the affected form validation methods.
Recommended action: Upgrade to 1.48 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Amazon EC2 Plugin printed a log message that contained the beginning of the private key to the Jenkins system log. The log message no longer includes the beginning of the private key.
Recommended action: Upgrade to 1.44 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Users with permission to create or configure agents in Jenkins 1.37 and earlier could configure an EC2 agent to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of these agents now requires the 'Run Scripts' permission typically only granted to administrators.
Recommended action: Upgrade to 1.38 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.