https://bugzilla.redhat.com/show_bug.cgi?id=1418730
Bug ID: 1418730
Summary: CVE-2017-2612 jenkins: Low privilege users were able
to override JDK download credentials (SECURITY-392)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
Jenkins allows administrators to enter their username and password to the
Oracle download site which provides JDKs for download. Users with read access
to Jenkins were able to override these credentials, resulting in future builds
possibly failing to download a JDK. A permission check has been added.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/b0ed9669bc00dbccf1be6896bb527b4…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418729
Bug ID: 1418729
Summary: CVE-2017-2611 jenkins: Insufficient permission check
for periodic processes (SECURITY-389)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission
checks, allowing users with read access to Jenkins to trigger these background
processes (that are otherwise performed daily), possibly causing additional
load on Jenkins master and agents.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/97a61a9fe55f4c16168c123f98301a5…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418727
Bug ID: 1418727
Summary: CVE-2017-2610 jenkins: Persisted cross-site scripting
vulnerability in search suggestions (SECURITY-388)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
Jenkins allows the creation of users with less-than and greater-than characters
in their names. These user names were not escaped when displaying search
suggestions, resulting in a cross-site scripting vulnerability.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/307ed31caba68a46426b8c73a787a05…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418726
Bug ID: 1418726
Summary: CVE-2017-2609 jenkins: Information disclosure
vulnerability in search suggestions (SECURITY-385)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The autocompletion for the search box provided the names of views the current
user does not have access to in its suggestions. These suggestions were
removed.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/13905d8224899ba7332fe9af4e330ea…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418724
Bug ID: 1418724
Summary: CVE-2017-2608 jenkins: XStream remote code execution
vulnerability (SECURITY-383)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
XStream-based APIs in Jenkins (e.g. /createItem URLs, or POST config.xml remote
API) were vulnerable to a remote code execution vulnerability involving the
deserialization of various types in javax.imageio.
In case this extension of the blacklist results in regressions, the blacklist
can be customized as described in the Jenkins LTS upgrade guide for Jenkins
2.19.3.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/a814154695e23dc37542af7d40cacc1…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418719
Bug ID: 1418719
Summary: CVE-2017-2607 jenkins: Persisted cross-site scripting
vulnerability in console notes (SECURITY-382)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
Jenkins allows plugins to annotate build logs, adding new content or changing
the presentation of existing content while the build is running. Popular
examples include the highlighting of sections by Ant Plugin, or the timestamp
metadata from Timestamper. Malicious Jenkins users, or users with SCM access,
could configure jobs or modify build scripts such that they print serialized
console notes that perform cross-site scripting attacks on Jenkins users
viewing the build logs.
To prevent this, console notes are now signed by Jenkins when created, and
Jenkins will only deserialize correctly signed console notes. As a side effect,
console notes created before updating to a release containing this fix will no
longer be deserialized. To restore the previous (unsafe) behavior, set the
system property hudson.console.ConsoleNote.INSECURE to true as described on
Features controlled by system properties.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/2527e66dd8f9dd23a2571f8bd8f2918…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418714
Bug ID: 1418714
Summary: CVE-2017-2604 jenkins: Low privilege users were able
to act on administrative monitors (SECURITY-371)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
Administrative monitors are warnings about the system state shown to Jenkins
admins. They sometimes provide actions to e.g. automatically address the
reported problem, or disable the warning. These actions were not consistently
protected by permission checks, thereby allowing low privilege users to act on
them.
All administrative monitors now require the user accessing them to be an
administrator.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/6efcf6c2ac39bc5c59ac7251822be8d…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418696
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1395176
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1434329
Bug ID: 1434329
Summary: CVE-2017-2648 jenkins-ssh-slaves-plugin: Host keys
were not verified
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
msrb(a)redhat.com
The SSH Slaves Plugin did not perform host key verification, thereby enabling
Man-in-the-Middle attacks.
External Reference:
https://jenkins.io/security/advisory/2017-03-20/
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=652183
Bug 652183 depends on bug 1429272, which changed state.
Bug 1429272 Summary: Re-Review Request: zanata-platform - Zanata the web-based translation platform
https://bugzilla.redhat.com/show_bug.cgi?id=1429272
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Resolution|--- |ERRATA
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.