Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. The affected URLs are: - http[s]://[host]/context/rdJob/ - http[s]://[host]/context/api//incubator/jobs Impact Rundeck, Process Automation version 4.12.0 up to 4.16.0 Patches Patched versions: 4.17.3 Workarounds Access to two URLs used in either Rundeck Open Source or Process Automation products could be blocked at a load balancer level. - http[s]://host/context/rdJob/ - http[s]://host/context/api//incubator/jobs For more information If you have any questions or comments about this advisory: Open an issue in our forums Enterprise Customers can open a Support ticket
Recommended action: Upgrade to 4.17.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly not working. Any credentials created or overwritten using Rundeck 4.2.0 or 4.2.1 might result in them being written in plaintext to the backend storage. If you are using a "Storage Converter" plugin, such as jasypt-encryption configured via the rundeck.storage.converter.1.type=jasypt-encryption setting, and you installed 4.2.0 or 4.2.1 then please upgrade to one of the patched versions. If you do not use a "Storage Converter" plugin, this would not affect you. Patches Rundeck 4.3.2 and 4.2.3 have fixed the code and upon upgrade will re-encrypt any plain text values. The fix is also included in 4.4.0 and later releases. Note: 4.3.0 does not have the vulnerability, but does not include the patch to re-encrypt plain text values if 4.2.0 or 4.2.1 were used. The previously release 4.3.1 and 4.2.2 versions missed some…
Recommended action: Upgrade to 4.3.1 or 4.2.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/wfitemEdit.gsp.
Recommended action: Upgrade to 3.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is tightly restricted and all users on the system have access to all projects, this is not really much of an issue. If access is wider and allows login for users that do not have access to any projects, or project access is restricted, there is a larger issue. If access is meant to be restricted and secrets, sensitive data, or intellectual property are exposed in Rundeck execution output and job data, the risk becomes much higher. Details An authenticated user could craft a request to: View Executions and download execution logs without access to read or view the associated Job, or ad-hoc resource. Get the list of running executions in a project, without Event read access, if they have read access…
Recommended action: Upgrade to 3.2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.