[Bug 1642877] CVE-2018-1000406 jenkins: Arbitrary file write vulnerability using file parameter definitions
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1642877
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mmccomas(a)redhat.com,
| |obulatov(a)redhat.com,
| |wzheng(a)redhat.com
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|1010,reported=20181010,sour |1010,reported=20181010,sour
|ce=internet,cvss3=6.5/CVSS: |ce=internet,cvss3=6.5/CVSS:
|3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U
|/C:H/I:N/A:N,cwe=CWE-22,fed |/C:H/I:N/A:N,cwe=CWE-22,fed
|ora-all/jenkins=affected,op |ora-all/jenkins=affected,op
|enshift-enterprise-3.1/jenk |enshift-enterprise-3.4/jenk
|ins=new,openshift-enterpris |ins=wontfix,openshift-enter
|e-3.2/jenkins=new,openshift |prise-3.5/jenkins=wontfix,o
|-enterprise-3.3/jenkins=new |penshift-enterprise-3.6/jen
|,openshift-enterprise-3.4/j |kins=wontfix,openshift-ente
|enkins=new,openshift-enterp |rprise-3.7/jenkins=wontfix,
|rise-3.5/jenkins=new,opensh |openshift-enterprise-3.9/je
|ift-enterprise-3.6/jenkins= |nkins=wontfix,openshift-ent
|new,openshift-enterprise-3. |erprise-3.10/jenkins=wontfi
|7/jenkins=new,openshift-ent |x,openshift-enterprise-3.11
|erprise-3.9/jenkins=new,ope |/jenkins=notaffected,opensh
|nshift-enterprise-3.10/jenk |ift-enterprise-4.1/jenkins=
|ins=new,openshift-enterpris |notaffected
|e-3.11/jenkins=new |
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years
[Bug 1642879] CVE-2018-1000407 jenkins: Reflected XSS vulnerability
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1642879
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mmccomas(a)redhat.com,
| |obulatov(a)redhat.com,
| |wzheng(a)redhat.com
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|1010,reported=20181010,sour |1010,reported=20181010,sour
|ce=internet,cvss3=6.5/CVSS: |ce=internet,cvss3=6.5/CVSS:
|3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U
|/C:N/I:H/A:N,cwe=CWE-79,fed |/C:N/I:H/A:N,cwe=CWE-79,fed
|ora-all/jenkins=affected,op |ora-all/jenkins=affected,op
|enshift-enterprise-3.1/jenk |enshift-enterprise-3.4/jenk
|ins=new,openshift-enterpris |ins=wontfix,openshift-enter
|e-3.2/jenkins=new,openshift |prise-3.5/jenkins=wontfix,o
|-enterprise-3.3/jenkins=new |penshift-enterprise-3.6/jen
|,openshift-enterprise-3.4/j |kins=wontfix,openshift-ente
|enkins=new,openshift-enterp |rprise-3.7/jenkins=wontfix,
|rise-3.5/jenkins=new,opensh |openshift-enterprise-3.9/je
|ift-enterprise-3.6/jenkins= |nkins=wontfix,openshift-ent
|new,openshift-enterprise-3. |erprise-3.10/jenkins=wontfi
|7/jenkins=new,openshift-ent |x,openshift-enterprise-3.11
|erprise-3.9/jenkins=new,ope |/jenkins=notaffected,opensh
|nshift-enterprise-3.10/jenk |ift-enterprise-4.1/jenkins=
|ins=new,openshift-enterpris |notaffected
|e-3.11/jenkins=new |
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years
[Bug 1642884] CVE-2018-1000408 jenkins: Ephemeral user record creation
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1642884
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mmccomas(a)redhat.com,
| |obulatov(a)redhat.com,
| |wzheng(a)redhat.com
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|1010,reported=20181010,sour |1010,reported=20181010,sour
|ce=internet,cvss3=6.5/CVSS: |ce=internet,cvss3=6.5/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U
|/C:N/I:L/A:L,cwe=CWE-400,fe |/C:N/I:L/A:L,cwe=CWE-400,fe
|dora-all/jenkins=affected,o |dora-all/jenkins=affected,o
|penshift-enterprise-3.1/jen |penshift-enterprise-3.4/jen
|kins=new,openshift-enterpri |kins=wontfix,openshift-ente
|se-3.2/jenkins=new,openshif |rprise-3.5/jenkins=wontfix,
|t-enterprise-3.3/jenkins=ne |openshift-enterprise-3.6/je
|w,openshift-enterprise-3.4/ |nkins=wontfix,openshift-ent
|jenkins=new,openshift-enter |erprise-3.7/jenkins=wontfix
|prise-3.5/jenkins=new,opens |,openshift-enterprise-3.9/j
|hift-enterprise-3.6/jenkins |enkins=wontfix,openshift-en
|=new,openshift-enterprise-3 |terprise-3.10/jenkins=wontf
|.7/jenkins=new,openshift-en |ix,openshift-enterprise-3.1
|terprise-3.9/jenkins=new,op |1/jenkins=notaffected,opens
|enshift-enterprise-3.10/jen |hift-enterprise-4.1/jenkins
|kins=new,openshift-enterpri |=notaffected
|se-3.11/jenkins=new |
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years
[Bug 1642885] CVE-2018-1000409 jenkins: Session fixation vulnerability on user signup
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1642885
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mmccomas(a)redhat.com,
| |obulatov(a)redhat.com,
| |wzheng(a)redhat.com
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|1010,reported=20181010,sour |1010,reported=20181010,sour
|ce=internet,cvss3=5.4/CVSS: |ce=internet,cvss3=5.4/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:R/S:U |3.0/AV:N/AC:L/PR:N/UI:R/S:U
|/C:L/I:L/A:N,cwe=CWE-384,fe |/C:L/I:L/A:N,cwe=CWE-384,fe
|dora-all/jenkins=affected,o |dora-all/jenkins=affected,o
|penshift-enterprise-3.1/jen |penshift-enterprise-3.4/jen
|kins=new,openshift-enterpri |kins=wontfix,openshift-ente
|se-3.2/jenkins=new,openshif |rprise-3.5/jenkins=wontfix,
|t-enterprise-3.3/jenkins=ne |openshift-enterprise-3.6/je
|w,openshift-enterprise-3.4/ |nkins=wontfix,openshift-ent
|jenkins=new,openshift-enter |erprise-3.7/jenkins=wontfix
|prise-3.5/jenkins=new,opens |,openshift-enterprise-3.9/j
|hift-enterprise-3.6/jenkins |enkins=wontfix,openshift-en
|=new,openshift-enterprise-3 |terprise-3.10/jenkins=wontf
|.7/jenkins=new,openshift-en |ix,openshift-enterprise-3.1
|terprise-3.9/jenkins=new,op |1/jenkins=notaffected,opens
|enshift-enterprise-3.10/jen |hift-enterprise-4.1/jenkins
|kins=new,openshift-enterpri |=notaffected
|se-3.11/jenkins=new |
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years
[Bug 1642892] CVE-2018-1000410 jenkins: Failures to process form submission data could result in secrets being displayed or written to logs
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1642892
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mmccomas(a)redhat.com,
| |obulatov(a)redhat.com,
| |wzheng(a)redhat.com
Whiteboard|impact=low,public=20181010, |impact=low,public=20181010,
|reported=20181010,source=in |reported=20181010,source=in
|ternet,cvss3=2.9/CVSS:3.0/A |ternet,cvss3=2.9/CVSS:3.0/A
|V:L/AC:H/PR:N/UI:N/S:U/C:L/ |V:L/AC:H/PR:N/UI:N/S:U/C:L/
|I:N/A:N,cwe=CWE-200,fedora- |I:N/A:N,cwe=CWE-200,fedora-
|all/jenkins=affected,opensh |all/jenkins=affected,opensh
|ift-enterprise-3.1/jenkins= |ift-enterprise-3.4/jenkins=
|new,openshift-enterprise-3. |wontfix,openshift-enterpris
|2/jenkins=new,openshift-ent |e-3.5/jenkins=wontfix,opens
|erprise-3.3/jenkins=new,ope |hift-enterprise-3.6/jenkins
|nshift-enterprise-3.4/jenki |=wontfix,openshift-enterpri
|ns=new,openshift-enterprise |se-3.7/jenkins=wontfix,open
|-3.5/jenkins=new,openshift- |shift-enterprise-3.9/jenkin
|enterprise-3.6/jenkins=new, |s=wontfix,openshift-enterpr
|openshift-enterprise-3.7/je |ise-3.10/jenkins=wontfix,op
|nkins=new,openshift-enterpr |enshift-enterprise-3.11/jen
|ise-3.9/jenkins=new,openshi |kins=notaffected,openshift-
|ft-enterprise-3.10/jenkins= |enterprise-4.1/jenkins=nota
|new,openshift-enterprise-3. |ffected
|11/jenkins=new |
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years
[Bug 1506612] CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1506612
Chess Hazlett <chazlett(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|71102,reported=20171014,sou |71102,reported=20171014,sou
|rce=researcher,cvss3=8.1/CV |rce=researcher,cvss3=8.1/CV
|SS:3.0/AV:N/AC:H/PR:N/UI:N/ |SS:3.0/AV:N/AC:H/PR:N/UI:N/
|S:U/C:H/I:H/A:H,cwe=CWE-184 |S:U/C:H/I:H/A:H,cwe=CWE-184
|,fedora-all/jackson-databin |,fedora-all/jackson-databin
|d=affected,amq-6/jackson-da |d=affected,amq-6/jackson-da
|tabind=notaffected,jdg-7/ja |tabind=notaffected,jdg-7/ja
|ckson-databind=notaffected, |ckson-databind=notaffected,
|jdv-6/jackson-databind=affe |jdv-6/jackson-databind=affe
|cted,eap-7/jackson-databind |cted,eap-7/jackson-databind
|=affected,bpms-6/jackson-da |=affected,bpms-6/jackson-da
|tabind=affected,brms-6/jack |tabind=affected,brms-6/jack
|son-databind=affected,fuse- |son-databind=affected,fuse-
|6/jackson-databind=notaffec |6/jackson-databind=notaffec
|ted,openshift-enterprise-2/ |ted,openshift-enterprise-2/
|jackson-databind=notaffecte |jackson-databind=notaffecte
|d,rhn_satellite_6/jackson-d |d,rhn_satellite_6/jackson-d
|atabind=affected/impact=low |atabind=affected/impact=low
|,rhmap-4/jackson-databind=n |,rhmap-4/jackson-databind=n
|otaffected,sam-1/jackson-da |otaffected,sam-1/jackson-da
|tabind=wontfix,rhev-m-3/jas |tabind=wontfix,rhev-m-3/jas
|perreports-server-pro=wontf |perreports-server-pro=wontf
|ix/impact=moderate,rhev-m-4 |ix/impact=moderate,rhev-m-4
|/eap7-jackson-databind=affe |/eap7-jackson-databind=affe
|cted/impact=moderate,rhscl- |cted/impact=moderate,rhscl-
|3/rh-eclipse46-jackson-data |3/rh-eclipse46-jackson-data
|bind=affected,jon-3/Core |bind=affected,jon-3/Core
|Server=notaffected,eap-6/ja |Server=notaffected,eap-6/ja
|ckson-databind=affected,dts |ckson-databind=affected,dts
|-4/devtoolset-4-jackson-dat |-4/devtoolset-4-jackson-dat
|abind=wontfix,rhscl-3/rh-ma |abind=wontfix,rhscl-3/rh-ma
|ven35-jackson-databind=affe |ven35-jackson-databind=affe
|cted |cted,fuse-7/jackson-databin
| |d=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years
[Bug 1353380] jenkins-2.164.2 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1353380
Upstream Release Monitoring <upstream-release-monitoring(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|jenkins-2.164.1 is |jenkins-2.164.2 is
|available |available
--- Comment #29 from Upstream Release Monitoring <upstream-release-monitoring(a)fedoraproject.org> ---
Latest upstream release: 2.164.2
Current version/release in rawhide: 1.651.3-10.fc30
URL: http://jenkins-ci.org/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/5493/
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years
[Bug 1516064] gradle-5.4.0-RC1 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1516064
Upstream Release Monitoring <upstream-release-monitoring(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|gradle-5.3.1 is available |gradle-5.4.0-RC1 is
| |available
--- Comment #30 from Upstream Release Monitoring <upstream-release-monitoring(a)fedoraproject.org> ---
Latest upstream release: 5.4.0-RC1
Current version/release in rawhide: 4.4.1-1.fc30
URL: http://www.gradle.org/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/6088/
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years