Skip to content

Commit 2215cfc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2vmr-8c82-x8xq GHSA-4653-9q2r-684q GHSA-j7r7-7qmf-xq87 GHSA-rh72-238f-g26q GHSA-2vmr-8c82-x8xq GHSA-4653-9q2r-684q GHSA-j7r7-7qmf-xq87 GHSA-rh72-238f-g26q
1 parent 956ee4b commit 2215cfc

File tree

8 files changed

+248
-144
lines changed

8 files changed

+248
-144
lines changed

‎advisories/github-reviewed/2025/10/GHSA-2vmr-8c82-x8xq/GHSA-2vmr-8c82-x8xq.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2vmr-8c82-x8xq",
4+
"modified": "2025-10-29T22:01:34Z",
5+
"published": "2025-10-29T15:31:56Z",
6+
"aliases": [
7+
"CVE-2025-64144"
8+
],
9+
"summary": "Jenkins ByteGuard Build Actions Plugin stores API tokens unencrypted in job config.xml files",
10+
"details": "Jenkins ByteGuard Build Actions Plugin 1.0 and earlier stores API tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.\n\nThese tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.\n\nAdditionally, the job configuration form does not mask these credentials, increasing the potential for attackers to observe and capture them.\n\nAs of publication of this advisory, there is no fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "io.jenkins.plugins:byteguard-build-actions"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "1.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64144"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/jenkinsci/byteguard-build-actions-plugin"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3560"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-311"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-10-29T22:01:34Z",
59+
"nvd_published_at": "2025-10-29T14:15:59Z"
60+
}
61+
}

‎advisories/github-reviewed/2025/10/GHSA-4653-9q2r-684q/GHSA-4653-9q2r-684q.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4653-9q2r-684q",
4+
"modified": "2025-10-29T22:02:03Z",
5+
"published": "2025-10-29T15:31:56Z",
6+
"aliases": [
7+
"CVE-2025-64143"
8+
],
9+
"summary": "Jenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files",
10+
"details": "Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.\n\nThese token can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.\n\nAs of publication of this advisory, there is no fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "com.openshift.jenkins:openshift-pipeline"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "1.0.57"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64143"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/jenkinsci/openshift-pipeline-plugin"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3553"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-311"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-10-29T22:02:03Z",
59+
"nvd_published_at": "2025-10-29T14:15:58Z"
60+
}
61+
}

‎advisories/github-reviewed/2025/10/GHSA-j7r7-7qmf-xq87/GHSA-j7r7-7qmf-xq87.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j7r7-7qmf-xq87",
4+
"modified": "2025-10-29T22:03:43Z",
5+
"published": "2025-10-29T15:31:56Z",
6+
"aliases": [
7+
"CVE-2025-64131"
8+
],
9+
"summary": "Jenkins SAML Plugin does not implement a replay cache",
10+
"details": "Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache.\n\nThis allows attackers able to obtain information about the SAML authentication flow between a user’s web browser and Jenkins to replay those requests, authenticating to Jenkins as that user.\n\nSAML Plugin 4.583.585.v22ccc1139f55 implements a replay cache that rejects replayed requests.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:saml"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "4.583.585.v22ccc1139f55"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64131"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/jenkinsci/saml-plugin/commit/6170b1013daf52770de29a66aeb57893aae1d7d6"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/jenkinsci/saml-plugin"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3613"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-294"
59+
],
60+
"severity": "HIGH",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-10-29T22:03:43Z",
63+
"nvd_published_at": "2025-10-29T14:15:57Z"
64+
}
65+
}

‎advisories/github-reviewed/2025/10/GHSA-rh72-238f-g26q/GHSA-rh72-238f-g26q.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rh72-238f-g26q",
4+
"modified": "2025-10-29T22:02:42Z",
5+
"published": "2025-10-29T15:31:56Z",
6+
"aliases": [
7+
"CVE-2025-64140"
8+
],
9+
"summary": "Jenkins Azure CLI Plugin does not restrict the commands it executes",
10+
"details": "Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller.\n\nThis allows attackers with Item/Configure permission to execute arbitrary shell commands on the Jenkins controller.\n\nAs of publication of this advisory, there is no fix.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:azure-cli"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.9"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64140"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/jenkinsci/azure-cli-plugin"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3538"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-78"
55+
],
56+
"severity": "HIGH",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-10-29T22:02:42Z",
59+
"nvd_published_at": "2025-10-29T14:15:58Z"
60+
}
61+
}

‎advisories/unreviewed/2025/10/GHSA-2vmr-8c82-x8xq/GHSA-2vmr-8c82-x8xq.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎advisories/unreviewed/2025/10/GHSA-4653-9q2r-684q/GHSA-4653-9q2r-684q.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎advisories/unreviewed/2025/10/GHSA-j7r7-7qmf-xq87/GHSA-j7r7-7qmf-xq87.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

0 commit comments

Comments
 (0)