Jenkins Security Advisory 2017-12-06

This advisory announces a vulnerability in this Jenkins plugin:

Description

SECURITY-643 / CVE-2017-1000502

Users with permission to create or configure agents in Jenkins could configure an EC2 agent to run arbitrary shell commands on the Jenkins controller whenever the agent was supposed to be launched.

Configuration of these agents now requires the Run Scripts permission typically only granted to administrators.

Severity

  • SECURITY-643: high

Affected versions

  • EC2 Plugin up to and including 1.37

Fix

  • EC2 Plugin should be updated to version 1.38

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

Credit

The Jenkins project would like to thank the reporter for discovering and reporting this vulnerability:

  • Jesse Glick, CloudBees Inc. for SECURITY-643