[Bug 1443635] New: CVE-2017-5645 log4j: Socket receiver deserialization vulnerability
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1443635
Bug ID: 1443635
Summary: CVE-2017-5645 log4j: Socket receiver deserialization
vulnerability
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
aortega(a)redhat.com, apevec(a)redhat.com,
avibelli(a)redhat.com, ayoung(a)redhat.com,
bkearney(a)redhat.com, bmcclain(a)redhat.com,
cbillett(a)redhat.com, chazlett(a)redhat.com,
chrisw(a)redhat.com, coneill(a)redhat.com,
csutherl(a)redhat.com, cvsbot-xmlrpc(a)redhat.com,
dandread(a)redhat.com, dblechte(a)redhat.com,
devrim(a)gunduz.org, dwalluck(a)redhat.com,
eedri(a)redhat.com, etirelli(a)redhat.com,
gklein(a)redhat.com, gsterlin(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hhorak(a)redhat.com, huwang(a)redhat.com,
java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jbalunas(a)redhat.com, jclere(a)redhat.com,
jcoleman(a)redhat.com, jjoyce(a)redhat.com,
jorton(a)redhat.com, jschluet(a)redhat.com,
jshepherd(a)redhat.com, kbasil(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lpetrovi(a)redhat.com, lsurette(a)redhat.com,
markmc(a)redhat.com, mbabacek(a)redhat.com,
mbaluch(a)redhat.com, meissner(a)suse.de,
mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
mwinkler(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
rbalakri(a)redhat.com, rbryant(a)redhat.com,
Rhev-m-bugs(a)redhat.com, rrajasek(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
sclewis(a)redhat.com, sherold(a)redhat.com,
spinder(a)redhat.com, srevivo(a)redhat.com,
taw(a)redhat.com, tcunning(a)redhat.com,
tdecacqu(a)redhat.com, theute(a)redhat.com,
thomas(a)suse.de, tjay(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com, tomckay(a)redhat.com,
twalsh(a)redhat.com, weli(a)redhat.com, ydary(a)redhat.com,
ykaul(a)redhat.com
When using the TCP socket server or UDP socket server to receive serialized log
events from another application, a specially crafted binary payload can be sent
that, when deserialized, can execute arbitrary code.
References:
http://seclists.org/oss-sec/2017/q2/78
Upstream bug:
https://issues.apache.org/jira/browse/LOG4J2-1863
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1510896] New: Problem to start tomcat with a user whose group has a name different to the user
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1510896
Bug ID: 1510896
Summary: Problem to start tomcat with a user whose group has a
name different to the user
Product: Fedora
Version: rawhide
Component: tomcat
Severity: medium
Assignee: ivan.afonichev(a)gmail.com
Reporter: csutherl(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, aneelica(a)redhat.com,
csutherl(a)redhat.com, djorm(a)redhat.com,
dknox(a)redhat.com, etienne.carriere(a)finances.gouv.fr,
hajek(a)oakland.edu, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jclere(a)redhat.com, jonderka(a)redhat.com,
krzysztof.daniel(a)gmail.com, lnovich(a)redhat.com,
luvilla(a)redhat.com, mbabacek(a)redhat.com,
mczernek(a)redhat.com, me(a)coolsvap.net,
mhasko(a)redhat.com, rhatlapa(a)redhat.com,
tfonteyn(a)redhat.com, tomcat-qe(a)redhat.com
Depends On: 1505762, 915447
Blocks: 835616
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=915447
[Bug 915447] Problem to start tomcat with a user whose group has a name
different to the user
https://bugzilla.redhat.com/show_bug.cgi?id=1505762
[Bug 1505762] Problem to start tomcat with a user whose group has a name
different to the user
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1545904] New: CVE-2018-6356 jenkins: Path traversal allows access to files outside plugin resources
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1545904
Bug ID: 1545904
Summary: CVE-2018-6356 jenkins: Path traversal allows access to
files outside plugin resources
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
A flaw was found in Jenkins weekly up to and including 2.106 and Jenkins LTS up
to and including 2.89.3. Jenkins did not properly prevent specifying relative
paths that escape a base directory for URLs accessing plugin resource files.
This allowed users with Overall/Read permission to download files from the
Jenkins master they should not have access to.
On Windows, any file accessible to the Jenkins master process could be
downloaded. On other operating systems, any file within the Jenkins home
directory accessible to the Jenkins master process could be downloaded.
References:
https://jenkins.io/security/advisory/2018-02-14/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1545899] New: jenkins: Improperly secured form validation for proxy configuration allows Server-Side Request Forgery
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1545899
Bug ID: 1545899
Summary: jenkins: Improperly secured form validation for proxy
configuration allows Server-Side Request Forgery
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
A flaw was found in Jenkins weekly up to and including 2.106 and Jenkins LTS up
to and including 2.89.3. The form validation for the proxy configuration form
did not check the permission of the user accessing it, allowing anyone with
Overall/Read access to Jenkins to cause Jenkins to send a GET request to a
specified URL, optionally with a specified proxy configuration.
If that request’s HTTP response code indicates success, the form validation is
returning a generic success message, otherwise the HTTP status code is
returned. It was not possible to reuse an existing proxy configuration to send
those requests; that configuration had to be provided by the attacker.
References:
https://jenkins.io/security/advisory/2018-02-14/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1526596] New: jenkins: CSRF protection delayed after startup
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1526596
Bug ID: 1526596
Summary: jenkins: CSRF protection delayed after startup
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
A race condition during Jenkins startup could result in the wrong order of
execution of commands during initialization.
There’s a very short window of time after startup during which Jenkins may no
longer show the "Please wait while Jenkins is getting ready to work" message,
but Cross-Site Request Forgery (CSRF) protection may not yet be effective.
External references:
https://jenkins.io/security/advisory/2017-12-14/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1522902] New: jenkins: Stored XSS vulnerability in tool names exploitable by administrators ( SECURITY-624)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1522902
Bug ID: 1522902
Summary: jenkins: Stored XSS vulnerability in tool names
exploitable by administrators (SECURITY-624)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Jenkins administrators can configure tools, such as JDK, Maven, or Ant, that
will be available in job configurations for use by build scripts.
Some tool names are not properly escaped on job configuration forms, resulting
in a stored cross-site scripting vulnerability.
Tools confirmed to be affected are:
JDK (provided by Jenkins core)
Ant (provided by Ant plugin)
Others may also be affected by this.
This vulnerability can only be exploited by Jenkins administrators, as they’re
the only ones able to define tools. In the vast majority of Jenkins
configurations, administrators are able to run any code and install any plugin.
Therefore this vulnerability only really affects installations that don’t grant
administrators the Run Scripts, Configure Update Sites, and Install Plugins
permissions.
The Jenkins project has prepared a plugin preventing the configuration of
unsafe tool names at https://github.com/jenkinsci-cert/security624 as a
workaround.
External References:
https://jenkins.io/security/advisory/2017-12-05/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1548284] New: CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1548284
Bug ID: 1548284
Summary: CVE-2018-1305 tomcat: Late application of security
constraints can lead to resource exposure for
unauthorised users [fedora-all]
Product: Fedora
Version: 27
Component: tomcat
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: ivan.afonichev(a)gmail.com
Reporter: sfowler(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1501817] New: jenkins: "Queue Item" remote API disclosed information about inaccessible jobs (SECURITY-618)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1501817
Bug ID: 1501817
Summary: jenkins: "Queue Item" remote API disclosed information
about inaccessible jobs (SECURITY-618)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
The remote API at /queue/item/(ID)/api showed information about tasks in the
queue (typically builds waiting to start). This included information about
tasks that the current user otherwise has no access to, e.g. due to lack of
Job/Read permission.
External References:
https://jenkins.io/security/advisory/2017-10-11/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1501816] New: jenkins: "Computer" remote API disclosed information about inaccessible jobs (SECURITY-611)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1501816
Bug ID: 1501816
Summary: jenkins: "Computer" remote API disclosed information
about inaccessible jobs (SECURITY-611)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
The remote API at /computer/(agent-name)/api showed information about tasks
(typically builds) currently running on that agent. This included information
about tasks that the current user otherwise has no access to, e.g. due to lack
of Job/Read permission.
External References:
https://jenkins.io/security/advisory/2017-10-11/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months