[Bug 1636512] New: CVE-2018-11784 tomcat: Open redirect in default servlet
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1636512
Bug ID: 1636512
Summary: CVE-2018-11784 tomcat: Open redirect in default
servlet
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, anstephe(a)redhat.com,
apintea(a)redhat.com, avibelli(a)redhat.com,
bgeorges(a)redhat.com, bkundal(a)redhat.com,
bmaxwell(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, cmoulliard(a)redhat.com,
coolsvap(a)gmail.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dimitris(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, fgavrilo(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hghasemb(a)redhat.com, hhorak(a)redhat.com,
ibek(a)redhat.com, ikanello(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdoyle(a)redhat.com, jolee(a)redhat.com,
jondruse(a)redhat.com, jorton(a)redhat.com,
jpallich(a)redhat.com, jschatte(a)redhat.com,
jshepherd(a)redhat.com, jstastny(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
loleary(a)redhat.com, lpetrovi(a)redhat.com,
lthon(a)redhat.com, mbabacek(a)redhat.com,
mizdebsk(a)redhat.com, mszynkie(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pgallagh(a)redhat.com,
pgier(a)redhat.com, pjurak(a)redhat.com,
ppalaga(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, pszubiak(a)redhat.com,
rnetuka(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
sdaley(a)redhat.com, spinder(a)redhat.com,
tcunning(a)redhat.com, theute(a)redhat.com,
tkirby(a)redhat.com, trogers(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
A flaw was found in Apache tomcat. When the default servlet returned a redirect
to a directory (e.g. redirecting to /foo/ when the user requested /foo) a
specially crafted URL could be used to cause the redirect to be generated to
any URI of the attackers choice.
References:
https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add2...
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months
[Bug 1620354] New: CVE-2018-1999047 jenkins: Unauthorized users could cancel scheduled restarts initiated from the update center
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1620354
Bug ID: 1620354
Summary: CVE-2018-1999047 jenkins: Unauthorized users could
cancel scheduled restarts initiated from the update
center
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1620339
Jenkins before LTS version 2.121.3 and weekly version 2.138 allow unauthorized
users to cancel scheduled restarts initiated from the update center.
Users with Overall/Read permission were able to access the URL used to cancel
scheduled restart jobs initiated via the update center ("Restart Jenkins when
installation is complete and no jobs are running") due to a lack of permission
checks.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-1076
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months
[Bug 1620351] New: CVE-2018-1999046 jenkins: Unauthorized users could access agent logs
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1620351
Bug ID: 1620351
Summary: CVE-2018-1999046 jenkins: Unauthorized users could
access agent logs
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1620339
Jenkins before LTS version 2.121.3 and weekly version 2.138 allow unauthorized
users to access agent logs.
Users with Overall/Read permission were able to access the URL serving agent
logs on the UI due to a lack of permission checks.
Access to the affected URL is now limited to users with the correct
Agent/Connect permission.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-1071
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months
[Bug 1620346] New: CVE-2018-1999045 jenkins: "Remember me" cookie was evaluated even if that feature is disabled
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1620346
Bug ID: 1620346
Summary: CVE-2018-1999045 jenkins: "Remember me" cookie was
evaluated even if that feature is disabled
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1620339
Jenkins before LTS version 2.121.3 and weekly version 2.138 do not properly
disable "Remember me" cookies.
The "Remember me" feature can be disabled in the Jenkins security
configuration.
This did not disable the processing of previously set "Remember me" cookies, so
they still allowed users to be logged in.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-996
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months
[Bug 1620344] New: CVE-2018-1999044 jenkins: Cron expression form validation could enter infinite loop, potentially resulting in denial of service
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1620344
Bug ID: 1620344
Summary: CVE-2018-1999044 jenkins: Cron expression form
validation could enter infinite loop, potentially
resulting in denial of service
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1620339
Jenkins before LTS version 2.121.3 and weekly version 2.138 are vulnerable to a
denial of service.
The form validation for cron expressions (e.g. "Poll SCM", "Build
periodically") could enter infinite loops when cron expressions only matching
certain rare dates were entered, blocking request handling threads
indefinitely.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-790
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months
[Bug 1620337] New: CVE-2018-1999042 jenkins: Deserialization of URL objects with host components
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1620337
Bug ID: 1620337
Summary: CVE-2018-1999042 jenkins: Deserialization of URL
objects with host components
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Jenkins before LTS version 2.121.3 and weekly version 2.138 allow
deserialization of URL objects via Remoting (agent communication) and XStream.
This could in rare cases be used by attackers to have Jenkins look up specified
hosts' DNS records.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-637
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months