[Bug 1561287] New: CVE-2018-8718 jenkins-plugin-mailer: Missing permissions check in Mailer.java:doSendTestMail() allows unauthorised users to send mail
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1561287
Bug ID: 1561287
Summary: CVE-2018-8718 jenkins-plugin-mailer: Missing
permissions check in Mailer.java:doSendTestMail()
allows unauthorised users to send mail
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dbaker(a)redhat.com,
dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, mchappel(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com
The Jenkins Mailer Plugin through version 1.20 is missing a permissions check
in the Mailer.java:doSendTestMail() function. Users with Overall/Read access
are able to connect to a user-specified mail server with user-specified
credentials to send a test email to a user-specified email address. The email
subject and body could not be changed. This could result in DoS if, for
example, specifying a valid mail server but invalid credentials.
As the same URL did not require POST to be used, it also was vulnerable to
cross-site request forgery.
Upstream Advisory:
https://jenkins.io/security/advisory/2018-03-26/
Upstream Patch:
https://github.com/jenkinsci/mailer-plugin/commit/98e79cf904769907f83894e...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years
[Bug 1522902] New: jenkins: Stored XSS vulnerability in tool names exploitable by administrators ( SECURITY-624)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1522902
Bug ID: 1522902
Summary: jenkins: Stored XSS vulnerability in tool names
exploitable by administrators (SECURITY-624)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Jenkins administrators can configure tools, such as JDK, Maven, or Ant, that
will be available in job configurations for use by build scripts.
Some tool names are not properly escaped on job configuration forms, resulting
in a stored cross-site scripting vulnerability.
Tools confirmed to be affected are:
JDK (provided by Jenkins core)
Ant (provided by Ant plugin)
Others may also be affected by this.
This vulnerability can only be exploited by Jenkins administrators, as they’re
the only ones able to define tools. In the vast majority of Jenkins
configurations, administrators are able to run any code and install any plugin.
Therefore this vulnerability only really affects installations that don’t grant
administrators the Run Scripts, Configure Update Sites, and Install Plugins
permissions.
The Jenkins project has prepared a plugin preventing the configuration of
unsafe tool names at https://github.com/jenkinsci-cert/security624 as a
workaround.
External References:
https://jenkins.io/security/advisory/2017-12-05/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years
[Bug 1538332] CVE-2018-5968 jackson-databind: unsafe deserialization due to incomplete blacklist ( incomplete fix for CVE-2017-7525 and CVE-2017-17485)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1538332
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0118,reported=20180122,sour |0118,reported=20180122,sour
|ce=cve,cvss3=8.1/CVSS:3.0/A |ce=cve,cvss3=8.1/CVSS:3.0/A
|V:N/AC:H/PR:N/UI:N/S:U/C:H/ |V:N/AC:H/PR:N/UI:N/S:U/C:H/
|I:H/A:H,cwe=CWE-502,jdv-6/j |I:H/A:H,cwe=CWE-502,jdv-6/j
|ackson-databind=new,jbds-10 |ackson-databind=new,jbds-10
|/jackson-databind=wontfix,a |/jackson-databind=wontfix,a
|mq-6/jackson-databind=notaf |mq-6/jackson-databind=notaf
|fected,bpms-6/jackson-datab |fected,bpms-6/jackson-datab
|ind=new,jdg-7/jackson-datab |ind=new,jdg-7/jackson-datab
|ind=affected,jbds-8/jackson |ind=affected,jbds-8/jackson
|-databind=wontfix,eap-7/jac |-databind=wontfix,eap-7/jac
|kson-databind=affected/impa |kson-databind=affected/impa
|ct=moderate/cvss3=8.1/CVSS: |ct=moderate/cvss3=8.1/CVSS:
|3.0/AV:N/AC:H/PR:N/UI:N/S:U |3.0/AV:N/AC:H/PR:N/UI:N/S:U
|/C:H/I:H/A:H,fuse-6/jackson |/C:H/I:H/A:H,fuse-6/jackson
|-databind=notaffected,rhsso |-databind=notaffected,rhsso
|-7/jackson-databind=new,sam |-7/jackson-databind=new,sam
|-1/jackson-databind=wontfix |-1/jackson-databind=wontfix
|,rhscl-3/rh-eclipse46-jacks |,rhscl-3/rh-eclipse46-jacks
|on-databind=affected,rhev-m |on-databind=affected,rhev-m
|-4/jackson-databind=affecte |-4/jackson-databind=affecte
|d,fedora-all/jackson-databi |d,fedora-all/jackson-databi
|nd=affected,openshift-1/jac |nd=affected,openshift-1/jac
|kson-databind=new,rhscl-3/r |kson-databind=affected,rhsc
|h-maven35-jackson-databind= |l-3/rh-maven35-jackson-data
|affected,rhn_satellite_6/ja |bind=affected,rhn_satellite
|ckson-databind=wontfix,eap- |_6/jackson-databind=wontfix
|6/jackson-databind=affected |,eap-6/jackson-databind=aff
|/impact=moderate/cvss3=8.1/ |ected/impact=moderate/cvss3
|CVSS:3.0/AV:N/AC:H/PR:N/UI: |=8.1/CVSS:3.0/AV:N/AC:H/PR:
|N/S:U/C:H/I:H/A:H |N/UI:N/S:U/C:H/I:H/A:H
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years