[Bug 1311949] New: CVE-2016-0791 jenkins: Non-constant time comparison of CSRF crumbs (SECURITY-245)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1311949
Bug ID: 1311949
Summary: CVE-2016-0791 jenkins: Non-constant time comparison of
CSRF crumbs (SECURITY-245)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The verification of user-provided CSRF crumbs with the expected value did not
use a constant-time comparison algorithm, potentially allowing attackers to use
statistical methods to determine valid CSRF crumbs using brute-force methods.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1311948] New: CVE-2016-0790 jenkins: Non-constant time comparison of API token (SECURITY-241)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1311948
Bug ID: 1311948
Summary: CVE-2016-0790 jenkins: Non-constant time comparison of
API token (SECURITY-241)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The verification of user-provided API tokens with the expected value did not
use a constant-time comparison algorithm, potentially allowing attackers to use
statistical methods to determine valid API tokens using brute-force methods.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1311947] New: CVE-2016-0789 jenkins: HTTP response splitting vulnerability (SECURITY-238)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1311947
Bug ID: 1311947
Summary: CVE-2016-0789 jenkins: HTTP response splitting
vulnerability (SECURITY-238)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
An HTTP response splitting vulnerability in the CLI command documentation
allowed attackers to craft Jenkins URLs that serve malicious content.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1311946] New: CVE-2016-0788 jenkins: Remote code execution vulnerability in remoting module (SECURITY-232)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1311946
Bug ID: 1311946
Summary: CVE-2016-0788 jenkins: Remote code execution
vulnerability in remoting module (SECURITY-232)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
A vulnerability in the Jenkins remoting module allowed unauthenticated remote
attackers to open a JRMP listener on the server hosting the Jenkins master
process, which allowed arbitrary code execution.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1311102] New: CVE-2016-0763 tomcat: security manager bypass via setGlobalContext() [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1311102
Bug ID: 1311102
Summary: CVE-2016-0763 tomcat: security manager bypass via
setGlobalContext() [fedora-all]
Product: Fedora
Version: 23
Component: tomcat
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: ivan.afonichev(a)gmail.com
Reporter: anemec(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
Blocks: 1311093 (CVE-2016-0763)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
[Bug 1311093] CVE-2016-0763 tomcat: security manager bypass via
setGlobalContext()
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months