https://bugzilla.redhat.com/show_bug.cgi?id=1418724
Bug ID: 1418724
Summary: CVE-2017-2608 jenkins: XStream remote code execution
vulnerability (SECURITY-383)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
XStream-based APIs in Jenkins (e.g. /createItem URLs, or POST config.xml remote
API) were vulnerable to a remote code execution vulnerability involving the
deserialization of various types in javax.imageio.
In case this extension of the blacklist results in regressions, the blacklist
can be customized as described in the Jenkins LTS upgrade guide for Jenkins
2.19.3.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/a814154695e23dc37542af7d40cacc1…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418726
Bug ID: 1418726
Summary: CVE-2017-2609 jenkins: Information disclosure
vulnerability in search suggestions (SECURITY-385)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The autocompletion for the search box provided the names of views the current
user does not have access to in its suggestions. These suggestions were
removed.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/13905d8224899ba7332fe9af4e330ea…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418727
Bug ID: 1418727
Summary: CVE-2017-2610 jenkins: Persisted cross-site scripting
vulnerability in search suggestions (SECURITY-388)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
Jenkins allows the creation of users with less-than and greater-than characters
in their names. These user names were not escaped when displaying search
suggestions, resulting in a cross-site scripting vulnerability.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/307ed31caba68a46426b8c73a787a05…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418729
Bug ID: 1418729
Summary: CVE-2017-2611 jenkins: Insufficient permission check
for periodic processes (SECURITY-389)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission
checks, allowing users with read access to Jenkins to trigger these background
processes (that are otherwise performed daily), possibly causing additional
load on Jenkins master and agents.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/97a61a9fe55f4c16168c123f98301a5…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418730
Bug ID: 1418730
Summary: CVE-2017-2612 jenkins: Low privilege users were able
to override JDK download credentials (SECURITY-392)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
Jenkins allows administrators to enter their username and password to the
Oracle download site which provides JDKs for download. Users with read access
to Jenkins were able to override these credentials, resulting in future builds
possibly failing to download a JDK. A permission check has been added.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/b0ed9669bc00dbccf1be6896bb527b4…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418698
Bug ID: 1418698
Summary: CVE-2017-2599 jenkins: Items could be created with
same name as existing item (SECURITY-321)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
An insufficient permission check allowed users with the permission to create
new items (e.g. jobs) to overwrite existing items they don't have access to.
After a Jenkins restart, children of the original item, such as builds, were
then accessible in some circumstances.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/4ed5c850b6855ab064a66d02fb338f3…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418703
Bug ID: 1418703
Summary: CVE-2017-2600 jenkins: Node monitor data could be
viewed by low privilege users (SECURITY-343)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
Overall/Read permission was sufficient to access node monitor data via the
remote API. These included system configuration and runtime information of
these nodes.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/0f92cd08a19207de2cceb6a2f4e3e9f…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1418707
Bug ID: 1418707
Summary: CVE-2017-2601 jenkins: Persisted cross-site scripting
vulnerability in parameter names and descriptions
(SECURITY-353)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
Users with the permission to configure jobs were able to inject JavaScript into
parameter names and descriptions.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017…
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/fd2e081b947124c90bcd97bfc55e1a7…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1434329
Bug ID: 1434329
Summary: CVE-2017-2648 jenkins-ssh-slaves-plugin: Host keys
were not verified
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
msrb(a)redhat.com
The SSH Slaves Plugin did not perform host key verification, thereby enabling
Man-in-the-Middle attacks.
External Reference:
https://jenkins.io/security/advisory/2017-03-20/
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=652183
Bug 652183 depends on bug 1429272, which changed state.
Bug 1429272 Summary: Re-Review Request: zanata-platform - Zanata the web-based translation platform
https://bugzilla.redhat.com/show_bug.cgi?id=1429272
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Resolution|--- |ERRATA
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.