Jenkins Security Advisory: OIDC Auth Bypass & Credential Exposure

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Description: - Exposure of multi-line secrets through error messages in Jenkins: Jenkins 2.478 and earlier versions, LTS 2.462.2 and earlier versions, do not encrypt multi-line secret values in error messages. - Item creation restriction bypass vulnerability in Jenkins: Jenkins's API allows fine-grained control over item creation, but attackers can bypass these restrictions via the Item/Create permission. - Encrypted values of credentials revealed to users with Extended Read permission in Credentials Plugin: Credentials Plugin 1380 and earlier versions do not encrypt key values when accessing configuration files. - Lack of audience claim validation in OpenId Connect Authentication Plugin: OpenId Connect Authentication Plugin 4.354 and earlier versions do not validate the Audience claim during authentication. - Lack of issuer claim validation in OpenId Connect Authentication Plugin: OpenId Connect Authentication Plugin 4.355 and earlier versions do not validate the Issuer claim during authentication. 2. Vulnerability Impact: - Exposure of multi-line secrets through error messages in Jenkins: May lead to leakage of multi-line secret values in error messages. - Item creation restriction bypass vulnerability in Jenkins: Allows attackers to bypass item creation restrictions. 图 - Encrypted values of credentials revealed to users with Extended Read permission in Credentials Plugin: Allows users with Extended Read permission to view encrypted credentials. - Lack of audience claim validation in OpenId Connect Authentication Plugin: May allow attackers to bypass authentication processes. - Lack of issuer claim validation in OpenId Connect Authentication Plugin: May allow attackers to bypass authentication processes. 3. Vulnerability Severity: - Exposure of multi-line secrets through error messages in Jenkins: Medium. - Item creation restriction bypass vulnerability in Jenkins: Medium. - Encrypted values of credentials revealed to users with Extended Read permission in Credentials Plugin: Medium. - Lack of audience claim validation in OpenId Connect Authentication Plugin: High. - Lack of issuer claim validation in OpenId Connect Authentication Plugin: High. 4. Affected Versions: - Jenkins weekly: 2.478 and earlier. - Jenkins LTS: 2.462.2 and earlier. - Credentials Plugin: 1380 and earlier. - OpenId Connect Authentication Plugin: 4.354 and earlier. 5. Remediation: - Upgrade to the specified versions of Jenkins, Credentials Plugin, and OpenId Connect Authentication Plugin. 6. Acknowledgments: - Thank you to the individuals who reported these vulnerabilities. This information helps users understand the nature, scope of impact, and remediation steps for these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: OIDC Auth Bypass & Credential Exposure