This issue is likely to be exploited in situations such as a cross-site request forgery (CSRF) attack, where a Jenkins master running on attacker-controlled hardware is used to control, read, and write to vulnerable agents on other Jenkins instances. This issue affects all major Jenkins releases from v1.573 to v2.x, with the exception of v1.605, which is not affected by this issue. Jenkins v1.605 was the last major release to support Windows XP. Topaz for Total Test Plugin 2.4.8 and earlier was the last major release to support Windows XP. Topaz for Total Test Plugin 2.4.9 and later is not affected by this issue. Topaz for Release Management Plugin 2.4.8 and earlier is not affected by this issue. Topaz for Build plugin 2.4.8 and earlier is not affected by this issue. Topaz for Test Results plugin 2.4.8 and earlier is not affected by this issue. Topaz for Reporting plugin 2.4.8 and earlier is not affected by this issue. Topaz for Mantis plugin 2.4.8 and earlier is not affected by this issue. Topaz for Email plugin 2.4.8 and earlier is not affected by this issue. Topaz for Mobile plugin 2.4.8 and earlier is not affected by this issue. Topaz for IP address plugin 2.4.8 and earlier is not affected by this issue.
Installation
Jenkins does not bundle the Topaz for Total Test plugin, and must be installed separately. To install Topaz for Total Test Plugin 2.4.8 or later, please follow these instructions:
1) Install Topaz for Total Test Plugin 2.4.8 or later from GitHub or your Jenkins remote repository:
https://github.com/TopazSoft/Total-Test-Plugin
2) In Jenkins, go to Manage Plugins > Available > search for Topaz for Total Test Plugin 2.4.8 or later and install it
3) Restart Jenkins
Summary of unaffected features
Topaz for Total Test Plugin 2.4.8 and earlier is not affected by this issue. Topaz for Release Management Plugin 2.4.8 and earlier is not affected by this issue. Topaz for Build plugin 2.4.8 and earlier is not affected by this issue. Topaz for Test Results plugin 2.4.8 and earlier is not affected by this issue. Topaz for Reporting plugin 2.4.8 and earlier is not affected by this issue, but the vulnerability will be exploited when running Jenkins on Windows XP or older versions of Windows if these plugins are enabled in the same installation of Jenkins that runs on Windows 7 or later (this issue affects all major Jenkins releases from v1.573 to v2, with the exception of v1.605, which is not affected).
What is Jenkins?
Jenkins is an open-source automation server created by Kohsuke Kawaguchi. Jenkins provides continuous integration and build management through the use of plugins. Jenkins can be continuously integrated with GitHub or other SCMs such as Bitbucket, and can also be integrated with other CI servers.
Timeline
Published on: 10/19/2022 16:15:00 UTC
Last modified on: 10/22/2022 02:24:00 UTC