[Bug 1205632] New: CVE-2015-1811 jenkins: External entity processing in XML can reveal sensitive local files (SECURITY-167)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1205632
Bug ID: 1205632
Summary: CVE-2015-1811 jenkins: External entity processing in
XML can reveal sensitive local files (SECURITY-167)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: vkaigoro(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com
This vulnerability allows attackers to create malicious XML documents and feed
that into Jenkins, which causes Jenkins to retrieve arbitrary XML document on
the server, resulting in the exposure of sensitive information inside/outside
Jenkins.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ZHDBSZCgVg&a=cc_unsubscribe
8 years, 6 months
[Bug 1205625] New: CVE-2015-1809 jenkins: external entity injection via XPath (SECURITY-165)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1205625
Bug ID: 1205625
Summary: CVE-2015-1809 jenkins: external entity injection via
XPath (SECURITY-165)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: vkaigoro(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com
This vulnerability allows users with the read access to Jenkins to retrieve
arbitrary XML document on the server, resulting in the exposure of sensitive
information inside/outside Jenkins.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=hLJy24Ki14&a=cc_unsubscribe
8 years, 6 months
[Bug 1205623] New: CVE-2015-1808 jenkins: update center metadata retrieval DoS attack (SECURITY-163)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1205623
Bug ID: 1205623
Summary: CVE-2015-1808 jenkins: update center metadata
retrieval DoS attack (SECURITY-163)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: vkaigoro(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com
This vulnerability allows authenticated users to disrupt the operation of
Jenkins by feeding malicious update center data into Jenkins, affecting plugin
installation and tool installation.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=VC6P9X4fvt&a=cc_unsubscribe
8 years, 6 months
[Bug 1230761] New: CVE-2015-4165 elasticsearch: unspecified arbitrary files modification vulnerability
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1230761
Bug ID: 1230761
Summary: CVE-2015-4165 elasticsearch: unspecified arbitrary
files modification vulnerability
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: vkaigoro(a)redhat.com
CC: bkabrda(a)redhat.com, bkearney(a)redhat.com,
bobjensen(a)gmail.com, cbillett(a)redhat.com,
cpelland(a)redhat.com, cperry(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jvanek(a)redhat.com, katello-bugs(a)redhat.com,
kseifried(a)redhat.com, mmccune(a)redhat.com,
ohadlevy(a)redhat.com, pbrobinson(a)gmail.com,
tjay(a)redhat.com, tomckay(a)redhat.com, zbyszek(a)in.waw.pl
All Elasticsearch versions from 1.0.0 to 1.5.2 are vulnerable to an attack that
uses Elasticsearch to modify files read and executed by certain other
applications.
Upstream bug/commit unknown at the time of writing.
Mitigation:
===========
Users should upgrade to 1.6.0. Alternately, ensure that other applications are
not present on the system, or that Elasticsearch cannot write into areas where
these applications would read.
External References:
https://www.elastic.co/community/security/
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=H4BjU1KRX1&a=cc_unsubscribe
8 years, 8 months
[Bug 1230765] New: CVE-2015-4165 elasticsearch: unspecified arbitrary files modification vulnerability [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1230765
Bug ID: 1230765
Summary: CVE-2015-4165 elasticsearch: unspecified arbitrary
files modification vulnerability [fedora-all]
Product: Fedora
Version: 22
Component: elasticsearch
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: jvanek(a)redhat.com
Reporter: vkaigoro(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: bkabrda(a)redhat.com, bobjensen(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jvanek(a)redhat.com, pbrobinson(a)gmail.com,
zbyszek(a)in.waw.pl
Blocks: 1230761 (CVE-2015-4165)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1230761
[Bug 1230761] CVE-2015-4165 elasticsearch: unspecified arbitrary files
modification vulnerability
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=PfCHFlzQOT&a=cc_unsubscribe
8 years, 8 months