[Bug 1335422] New: CVE-2016-3727 jenkins: Granting the permission to read node configurations allows access to overall system configuration (SECURITY-281)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1335422
Bug ID: 1335422
Summary: CVE-2016-3727 jenkins: Granting the permission to read
node configurations allows access to overall system
configuration (SECURITY-281)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The API URL /computer/(master)/api/xml allowed users with the 'extended read'
permission for the master node to see some global Jenkins configuration,
including the configuration of the security realm.
This URL now unconditionally sends HTTP 400 Bad Request when accessed. There is
no workaround.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1335421] New: CVE-2016-3726 jenkins: Open redirect to scheme-relative URLs (SECURITY-276)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1335421
Bug ID: 1335421
Summary: CVE-2016-3726 jenkins: Open redirect to
scheme-relative URLs (SECURITY-276)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com
The following flaw was found in Jenkins:
Some Jenkins URLs did not properly validate the redirect URLs, which allowed
malicious users to create URLs that redirect users to arbitrary scheme-relative
URLs.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1335420] New: CVE-2016-3725 jenkins: Regular users can trigger download of update site metadata (SECURITY-273)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1335420
Bug ID: 1335420
Summary: CVE-2016-3725 jenkins: Regular users can trigger
download of update site metadata (SECURITY-273)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com
The following flaw was found in Jenkins:
A missing permissions check allowed any user with access to Jenkins to trigger
an update of update site metadata. This could be combined with DNS cache
poisoning to disrupt Jenkins service.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1335418] New: CVE-2016-3724 jenkins: Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration (SECURITY-266)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1335418
Bug ID: 1335418
Summary: CVE-2016-3724 jenkins: Encrypted secrets (e.g.
passwords) were leaked to users with permission to
read configuration (SECURITY-266)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com
The following flaw was found in Jenkins:
Users with extended read access could access encrypted secrets stored directly
in the configuration of those items.
As a side-effect of this change, copying a job that contains secrets in its
configuration now requires the Configure permission on that job.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1335417] New: CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1335417
Bug ID: 1335417
Summary: CVE-2016-3723 jenkins: Information on installed
plugins exposed via API (SECURITY-250)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The XML/JSON API endpoints providing information about installed plugins were
missing permissions checks, allowing any user with read access to Jenkins to
determine which plugins and versions were installed.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1335416] New: CVE-2016-3722 jenkins: Malicious users with multiple user accounts can prevent other users from logging in (SECURITY-243)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1335416
Bug ID: 1335416
Summary: CVE-2016-3722 jenkins: Malicious users with multiple
user accounts can prevent other users from logging in
(SECURITY-243)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com
The following flaw was found in Jenkins:
By changing the freely editable 'full name', malicious users with multiple user
accounts could prevent other users from logging in, as 'full name' was resolved
before actual user name to determine which account is currently trying to log
in.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1335415] New: CVE-2016-3721 jenkins: Arbitrary build parameters are passed to build scripts as environment variables (SECURITY-170)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1335415
Bug ID: 1335415
Summary: CVE-2016-3721 jenkins: Arbitrary build parameters are
passed to build scripts as environment variables
(SECURITY-170)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com
The following flaw was found in Jenkins:
Build parameters in Jenkins typically are passed to build scripts as
environment variables. Some plugins allow passing arbitrary (undeclared)
parameters. Depending on access permissions and installed plugins, malicious
users were able to trigger builds, passing arbitrary environment variables
(e.g. PATH) to modify the behavior of those builds. Rather than expect all
plugin authors to be aware of this potential problem, Jenkins now filters the
build parameters based on what is defined on the job.
As this change is known to affect a number of plugins, it's possible to restore
the previous behavior by setting the system property
hudson.model.ParametersAction.keepUndefinedParameters to true. This is
potentially very unsafe and intended as a short-term workaround only.
To allow specific, known safe parameter names to be passed to builds, set the
system property hudson.model.ParametersAction.safeParameters to a
comma-separated list of safe parameter names. Example:
java -Dhudson.model.ParametersAction.safeParameters=FOO,BAR_BAZ,qux -jar
jenkins.war
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1353902] New: CVE-2015-5007 spring: Path matching inconsistency
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1353902
Bug ID: 1353902
Summary: CVE-2015-5007 spring: Path matching inconsistency
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, alonbl(a)redhat.com,
bazulay(a)redhat.com, bmcclain(a)redhat.com,
dblechte(a)redhat.com, dmcphers(a)redhat.com,
eedri(a)redhat.com, gklein(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
lsurette(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, oourfali(a)redhat.com,
puntogil(a)libero.it, rbalakri(a)redhat.com,
Rhev-m-bugs(a)redhat.com, sbonazzo(a)redhat.com,
sherold(a)redhat.com, srevivo(a)redhat.com,
sshumake(a)redhat.com, tiwillia(a)redhat.com,
ydary(a)redhat.com, ykaul(a)redhat.com
Both Spring Security and the Spring Framework rely on URL pattern mappings for
authorization and for mapping requests to controllers respectively. It was
found that differences in the strictness of the pattern matching mechanisms,
for example with regards to space trimming in path segments, can lead Spring
Security to not recognize certain paths as not protected that are in fact
mapped to Spring MVC controllers that should be protected.
Affected versions:
Spring Security 3.2.x, 4.0.x, 4.1.0
Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x
Other unsupported versions are also affected
Upstream patches:
https://github.com/spring-projects/spring-framework/commit/a30ab3
https://github.com/spring-projects/spring-security/commit/e4c13e
Upstream bug:
https://github.com/spring-projects/spring-security/issues/3964
External References:
https://pivotal.io/security/cve-2016-5007
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months