[Bug 1620354] New: CVE-2018-1999047 jenkins: Unauthorized users could cancel scheduled restarts initiated from the update center
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1620354
Bug ID: 1620354
Summary: CVE-2018-1999047 jenkins: Unauthorized users could
cancel scheduled restarts initiated from the update
center
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1620339
Jenkins before LTS version 2.121.3 and weekly version 2.138 allow unauthorized
users to cancel scheduled restarts initiated from the update center.
Users with Overall/Read permission were able to access the URL used to cancel
scheduled restart jobs initiated via the update center ("Restart Jenkins when
installation is complete and no jobs are running") due to a lack of permission
checks.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-1076
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1620351] New: CVE-2018-1999046 jenkins: Unauthorized users could access agent logs
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1620351
Bug ID: 1620351
Summary: CVE-2018-1999046 jenkins: Unauthorized users could
access agent logs
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1620339
Jenkins before LTS version 2.121.3 and weekly version 2.138 allow unauthorized
users to access agent logs.
Users with Overall/Read permission were able to access the URL serving agent
logs on the UI due to a lack of permission checks.
Access to the affected URL is now limited to users with the correct
Agent/Connect permission.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-1071
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1620346] New: CVE-2018-1999045 jenkins: "Remember me" cookie was evaluated even if that feature is disabled
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1620346
Bug ID: 1620346
Summary: CVE-2018-1999045 jenkins: "Remember me" cookie was
evaluated even if that feature is disabled
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1620339
Jenkins before LTS version 2.121.3 and weekly version 2.138 do not properly
disable "Remember me" cookies.
The "Remember me" feature can be disabled in the Jenkins security
configuration.
This did not disable the processing of previously set "Remember me" cookies, so
they still allowed users to be logged in.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-996
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1620344] New: CVE-2018-1999044 jenkins: Cron expression form validation could enter infinite loop, potentially resulting in denial of service
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1620344
Bug ID: 1620344
Summary: CVE-2018-1999044 jenkins: Cron expression form
validation could enter infinite loop, potentially
resulting in denial of service
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1620339
Jenkins before LTS version 2.121.3 and weekly version 2.138 are vulnerable to a
denial of service.
The form validation for cron expressions (e.g. "Poll SCM", "Build
periodically") could enter infinite loops when cron expressions only matching
certain rare dates were entered, blocking request handling threads
indefinitely.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-790
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1620337] New: CVE-2018-1999042 jenkins: Deserialization of URL objects with host components
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1620337
Bug ID: 1620337
Summary: CVE-2018-1999042 jenkins: Deserialization of URL
objects with host components
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Jenkins before LTS version 2.121.3 and weekly version 2.138 allow
deserialization of URL objects via Remoting (agent communication) and XStream.
This could in rare cases be used by attackers to have Jenkins look up specified
hosts' DNS records.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-637
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1593262] New: javacc-7.0.3 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1593262
Bug ID: 1593262
Summary: javacc-7.0.3 is available
Product: Fedora
Version: rawhide
Component: javacc
Keywords: FutureFeature, Triaged
Assignee: msimacek(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, jaromir.capik(a)email.cz,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com
Latest upstream release: 7.0.3
Current version/release in rawhide: 7.0.2-4.fc28
URL: http://javacc.org
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/1422/
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1571050] New: CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1571050
Bug ID: 1571050
Summary: CVE-2018-1271 spring-framework: Directory traversal
vulnerability with static resources on Windows
filesystems
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, apevec(a)redhat.com,
bkundal(a)redhat.com, bmaxwell(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
chrisw(a)redhat.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dchen(a)redhat.com,
dffrench(a)redhat.com, dimitris(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
drusso(a)redhat.com, etirelli(a)redhat.com,
gvarsami(a)redhat.com, hghasemb(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jjoyce(a)redhat.com, jmadigan(a)redhat.com,
jolee(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kbasil(a)redhat.com,
kconner(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, lgriffin(a)redhat.com, lhh(a)redhat.com,
lpeer(a)redhat.com, lpetrovi(a)redhat.com,
markmc(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, myarboro(a)redhat.com,
ngough(a)redhat.com, nwallace(a)redhat.com,
nyechiel(a)redhat.com, paradhya(a)redhat.com,
pavelp(a)redhat.com, pgier(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
pszubiak(a)redhat.com, puntogil(a)libero.it,
pwright(a)redhat.com, rbryant(a)redhat.com,
rhel8-maint(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sclewis(a)redhat.com,
sdaley(a)redhat.com, sisharma(a)redhat.com,
slinaber(a)redhat.com, smohan(a)redhat.com,
ssaha(a)redhat.com, tcunning(a)redhat.com,
tdecacqu(a)redhat.com, tjay(a)redhat.com,
tkirby(a)redhat.com, trepel(a)redhat.com,
twalsh(a)redhat.com, vbellur(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com
Spring Framework versions 5.0 to 5.0.4, 4.3 to 4.3.14, and older unsupported
versions allow applications to configure Spring MVC to serve static resources
(e.g. CSS, JS, images). When static resources are served from a file system on
Windows (as opposed to the classpath, or the ServletContext), a malicious user
can send a request using a specially crafted URL that can lead a directory
traversal attack.
This vulnerability does not affect applications that use versions of Spring
Security patched for CVE-2018-1199.
External Reference:
https://pivotal.io/security/cve-2018-1271
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months