[Bug 1501814] New: jenkins: "User" remote API disclosed users' email addresses (SECURITY-514)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1501814
Bug ID: 1501814
Summary: jenkins: "User" remote API disclosed users' email
addresses (SECURITY-514)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Information about Jenkins user accounts is generally available to anyone with
Overall/Read permissions via the /user/(username)/api remote API. This included
e.g. Jenkins users' email addresses if the Mailer Plugin is installed.
External References:
https://jenkins.io/security/advisory/2017-10-11/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1501820] New: jenkins: Jenkins core bundled vulnerable version of the commons-httpclient library (SECURITY-555)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1501820
Bug ID: 1501820
Summary: jenkins: Jenkins core bundled vulnerable version of
the commons-httpclient library (SECURITY-555)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Jenkins bundled a version of the commons-httpclient library with the
vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making
it susceptible to man-in-the-middle attacks.
External References:
https://jenkins.io/security/advisory/2017-10-11/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1501818] New: jenkins: "Job" remote API disclosed information about inaccessible upstream/ downstream jobs (SECURITY-617)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1501818
Bug ID: 1501818
Summary: jenkins: "Job" remote API disclosed information about
inaccessible upstream/downstream jobs (SECURITY-617)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
The remote API at /job/(job-name)/api contained information about upstream and
downstream projects. This included information about tasks that the current
user otherwise has no access to, e.g. due to lack of Job/Read permission.
External References:
https://jenkins.io/security/advisory/2017-10-11/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1434338] New: CVE-2017-2651 jenkins-mailer-plugin: Emails were sent to addresses not associated with actual users of Jenkins by Mailer Plugin
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1434338
Bug ID: 1434338
Summary: CVE-2017-2651 jenkins-mailer-plugin: Emails were sent
to addresses not associated with actual users of
Jenkins by Mailer Plugin
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com
The Mailer and Email Extension Plugins are able to send emails to a dynamically
created list of users based on the changelogs, like authors of SCM changes
since the last successful build.
This could in some cases result in emails being sent to people who have no user
account in Jenkins, and in rare cases even people who were not involved in
whatever project was being built, due to some mapping based on the local-part
of email addresses.
Affected versions: up to and including version 1.19
External Reference:
https://jenkins.io/security/advisory/2017-03-20/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1501812] New: jenkins: Arbitrary shell command execution on master by users with Agent-related permissions (SECURITY-478)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1501812
Bug ID: 1501812
Summary: jenkins: Arbitrary shell command execution on master
by users with Agent-related permissions (SECURITY-478)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Users with permission to create or configure agents in Jenkins could configure
a launch method called Launch agent via execution of command on master. This
allowed them to run arbitrary shell commands on the master node whenever the
agent was supposed to be launched.
External References:
https://jenkins.io/security/advisory/2017-10-11/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1501819] New: jenkins: Form validation for password fields was sent via GET (SECURITY-616)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1501819
Bug ID: 1501819
Summary: jenkins: Form validation for password fields was sent
via GET (SECURITY-616)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
The Jenkins default form control for passwords and other secrets,
<f:password/>, supports form validation (e.g. for API keys). The form
validation AJAX requests were sent via GET, which could result in secrets being
logged to a HTTP access log in non-default configurations of Jenkins, and made
available to users with access to these log files.
External References:
https://jenkins.io/security/advisory/2017-10-11/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1446114] New: CVE-2017-1000353 jenkins: Unauthenticated remote code execution (SECURITY-429)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1446114
Bug ID: 1446114
Summary: CVE-2017-1000353 jenkins: Unauthenticated remote code
execution (SECURITY-429)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
An unauthenticated remote code execution vulnerability allowed attackers to
transfer a serialized Java SignedObject object to the remoting-based Jenkins
CLI, that would be deserialized using a new ObjectInputStream, bypassing the
existing blacklist-based protection mechanism.
SignedObject has been added to the remoting blacklist.
In Jenkins 2.54, the remoting-based CLI protocol was deprecated and a new, HTTP
based protocol introduced as the new default, in addition to the existing
SSH-based CLI. This feature has been backported to Jenkins 2.46.2. It is
strongly recommended that users upgrading Jenkins disable the remoting-based
CLI, and use the one of the other modes (HTTP or SSH) instead.
Affected versions:
All Jenkins main line releases up to and including 2.56
All Jenkins LTS releases up to and including 2.46.1
Fixed in:
Jenkins main line users should update to 2.57
Jenkins LTS users should update to 2.46.2
External Reference:
https://jenkins.io/security/advisory/2017-04-26/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1321205] New: tomcat-8.5.0 is available
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1321205
Bug ID: 1321205
Summary: tomcat-8.5.0 is available
Product: Fedora
Version: rawhide
Component: tomcat
Keywords: FutureFeature, Triaged
Assignee: ivan.afonichev(a)gmail.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
Latest upstream release: 8.5.0
Current version/release in rawhide: 8.0.32-4.fc25
URL: http://tomcat.apache.org/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/4987/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months