[Bug 1282368] New: CVE-2015-5325 jenkins: JNLP slaves not subject to slave-to-master access control (SECURITY-206)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282368
Bug ID: 1282368
Summary: CVE-2015-5325 jenkins: JNLP slaves not subject to
slave-to-master access control (SECURITY-206)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
Slaves connecting via JNLP were not subject to the optional slave-to-master
access control documented at http://jenkins-ci.org/security-144
(CVE-2014-3665).
This flaw allows to circumvent the major protection against less trusted node
admins.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IK7A2heIu9&a=cc_unsubscribe
8 years, 1 month
[Bug 1282367] New: CVE-2015-5324 jenkins: Queue API did show items not visible to the current user (SECURITY-186)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282367
Bug ID: 1282367
Summary: CVE-2015-5324 jenkins: Queue API did show items not
visible to the current user (SECURITY-186)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
The /queue/api URL could return information about items not accessible to the
current user (such as parameter names and values, build names, project
descriptions, ...).
Low privileged users can gain some limited information about items they should
not have access to.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=43JguXYsQ1&a=cc_unsubscribe
8 years, 1 month
[Bug 1282366] New: CVE-2015-5323 jenkins: API tokens of other users available to admins (SECURITY-200)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282366
Bug ID: 1282366
Summary: CVE-2015-5323 jenkins: API tokens of other users
available to admins (SECURITY-200)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
API tokens of other users were exposed to admins by default. On instances that
don't implicitly grant RunScripts permission to admins, this allowed admins to
run scripts with another user's credentials.
In very specific circumstances, it allows admins to gain permissions they would
not otherwise have.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ZqXJZdyVqX&a=cc_unsubscribe
8 years, 1 month
[Bug 1282365] New: CVE-2015-5322 jenkins: Local file inclusion vulnerability (SECURITY-195)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282365
Bug ID: 1282365
Summary: CVE-2015-5322 jenkins: Local file inclusion
vulnerability (SECURITY-195)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
Access to the /jnlpJars/ URL was not limited to the specific JAR files users
needed to access, allowing browsing directories and downloading other files in
the Jenkins servlet resources, such as web.xml.
The information gained is very limited, and it requires a specific setup to
gain any non-public information this way.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IMdsIBEfX4&a=cc_unsubscribe
8 years, 1 month
[Bug 1282364] New: CVE-2015-5321 jenkins: Information disclosure via sidepanel (SECURITY-192)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282364
Bug ID: 1282364
Summary: CVE-2015-5321 jenkins: Information disclosure via
sidepanel (SECURITY-192)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
The CLI command overview and help pages in Jenkins were accessible without
Overall/Read permission, resulting in disclosure of the names of configured
slaves (and contents of other sidepanel widgets, if present) to unauthorized
users.
While the amount of information disclosed is very limited, it is trivial to
exploit this flaw.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=qw4nbq3cTD&a=cc_unsubscribe
8 years, 1 month
[Bug 1282363] New: CVE-2015-5320 jenkins: Secret key not verified when connecting a slave (SECURITY-184)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282363
Bug ID: 1282363
Summary: CVE-2015-5320 jenkins: Secret key not verified when
connecting a slave (SECURITY-184)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
JNLP slave connections did not verify that the correct secret was supplied,
which allowed malicious users to connect their own machines as slaves to
Jenkins knowing only the name of the slave. This enables attackers to take over
Jenkins (unless the slave-to-master security subsystem is enabled) or gain
access to private data like keys and source code.
This issue allowos for several different attacks, compromising integrity,
stability and confidentiality.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=iMwUEXpAua&a=cc_unsubscribe
8 years, 1 month
[Bug 1282362] New: CVE-2015-5319 jenkins: XXE injection into job configurations via CLI (SECURITY-173)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282362
Bug ID: 1282362
Summary: CVE-2015-5319 jenkins: XXE injection into job
configurations via CLI (SECURITY-173)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
When creating a job using the create-job CLI command, external entities are not
discarded (nor processed). If these job configurations are processed by another
user with an XML-aware tool (e.g. using get-job/update-job), information from
that user's computer may be disclosed to Jenkins and the attacker.
Exploiting this flaw requires a high degree of specific user interaction, and
the limited information that can be gained this way.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=lo259rTqud&a=cc_unsubscribe
8 years, 1 month
[Bug 1282359] New: CVE-2015-5317 jenkins: Project name disclosure via fingerprints (SECURITY-153)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282359
Bug ID: 1282359
Summary: CVE-2015-5317 jenkins: Project name disclosure via
fingerprints (SECURITY-153)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
The Jenkins UI allowed users to see the names of jobs and builds otherwise
inaccessible to them on the "Fingerprints" pages if those shared file
fingerprints with fingerprinted files in accessible jobs.
Users have no control over which information they see, and the kind of
information revealed is very limited.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AgVMzmSVXX&a=cc_unsubscribe
8 years, 1 month
[Bug 1282361] New: CVE-2015-5318 jenkins: Public value used for CSRF protection salt (SECURITY-169)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282361
Bug ID: 1282361
Summary: CVE-2015-5318 jenkins: Public value used for CSRF
protection salt (SECURITY-169)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
The salt used to generate the CSRF protection tokens was a publicly accessible
value, allowing malicious users to circumvent CSRF protection by generating the
correct token.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=0p8soP2ceJ&a=cc_unsubscribe
8 years, 1 month