[Bug 1282371] New: jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282371
Bug ID: 1282371
Summary: jenkins: Remote code execution vulnerability due to
unsafe deserialization in Jenkins remoting
(SECURITY-218)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
Unsafe deserialization allows unauthenticated remote attackers to run arbitrary
code on the Jenkins master.
This flaw could allow unauthenticated remote attackers to run arbitrary code on
Jenkins.
Mitigation:
https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-exe...
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=cAmrN8IiEj&a=cc_unsubscribe
8 years, 1 month
[Bug 1320844] New: CVE-2016-2166 qpid-proton-java: qpid-proton: reactor sends messages in clear if ssl is requested but not available [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1320844
Bug ID: 1320844
Summary: CVE-2016-2166 qpid-proton-java: qpid-proton: reactor
sends messages in clear if ssl is requested but not
available [fedora-all]
Product: Fedora
Version: 23
Component: qpid-proton-java
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: puntogil(a)libero.it
Reporter: anemec(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: iboverma(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Blocks: 1320842 (CVE-2016-2166)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1320842
[Bug 1320842] CVE-2016-2166 qpid-proton: reactor sends messages in clear
if ssl is requested but not available
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 1 month
[Bug 1282369] New: CVE-2015-5326 jenkins: Stored XSS vulnerability in slave offline status message (SECURITY-214)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282369
Bug ID: 1282369
Summary: CVE-2015-5326 jenkins: Stored XSS vulnerability in
slave offline status message (SECURITY-214)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
Users with the permission to take slave nodes offline can enter arbitrary HTML
that gets shown unescaped to users visiting the slave overview page.
This flaw allows admins and users with significant privileges to circumvent XSS
protection.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ModxPFNrI9&a=cc_unsubscribe
8 years, 1 month
[Bug 1282368] New: CVE-2015-5325 jenkins: JNLP slaves not subject to slave-to-master access control (SECURITY-206)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282368
Bug ID: 1282368
Summary: CVE-2015-5325 jenkins: JNLP slaves not subject to
slave-to-master access control (SECURITY-206)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
Slaves connecting via JNLP were not subject to the optional slave-to-master
access control documented at http://jenkins-ci.org/security-144
(CVE-2014-3665).
This flaw allows to circumvent the major protection against less trusted node
admins.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IK7A2heIu9&a=cc_unsubscribe
8 years, 1 month
[Bug 1282367] New: CVE-2015-5324 jenkins: Queue API did show items not visible to the current user (SECURITY-186)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282367
Bug ID: 1282367
Summary: CVE-2015-5324 jenkins: Queue API did show items not
visible to the current user (SECURITY-186)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
The /queue/api URL could return information about items not accessible to the
current user (such as parameter names and values, build names, project
descriptions, ...).
Low privileged users can gain some limited information about items they should
not have access to.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=43JguXYsQ1&a=cc_unsubscribe
8 years, 1 month