[Bug 1819217] New: CVE-2020-2162 jenkins: Content-Security-Policy headers for files uploaded leads to XSS [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819217
Bug ID: 1819217
Summary: CVE-2020-2162 jenkins: Content-Security-Policy headers
for files uploaded leads to XSS [fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: jenkins
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: darunesh(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1819199] New: CVE-2020-2161 jenkins: XSS in job configuration pages [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819199
Bug ID: 1819199
Summary: CVE-2020-2161 jenkins: XSS in job configuration pages
[fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: jenkins
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: darunesh(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1801381] New: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1801381
Bug ID: 1801381
Summary: CVE-2020-7226 cryptacular: excessive memory allocation
during a decode operation [fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: cryptacular
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: gsuckevi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1797087] New: CVE-2020-2100 jenkins: UDP multicast/broadcast service amplification reflection attack
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1797087
Bug ID: 1797087
Summary: CVE-2020-2100 jenkins: UDP multicast/broadcast service
amplification reflection attack
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: abenaiss(a)redhat.com, adam.kaplan(a)redhat.com,
aos-bugs(a)redhat.com, bmontgom(a)redhat.com,
eparis(a)redhat.com, extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com,
wzheng(a)redhat.com
Target Milestone: ---
Classification: Other
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP
amplification reflection denial of service attack on port 33848.
References:
https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1641
http://www.openwall.com/lists/oss-security/2020/01/29/1
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1797088] New: CVE-2020-2100 jenkins: UDP multicast/broadcast service amplification reflection attack [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1797088
Bug ID: 1797088
Summary: CVE-2020-2100 jenkins: UDP multicast/broadcast service
amplification reflection attack [fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: jenkins
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1797084] New: CVE-2020-2101 jenkins: Non-constant time comparison of inbound TCP agent connection secret
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1797084
Bug ID: 1797084
Summary: CVE-2020-2101 jenkins: Non-constant time comparison of
inbound TCP agent connection secret
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: abenaiss(a)redhat.com, adam.kaplan(a)redhat.com,
aos-bugs(a)redhat.com, bmontgom(a)redhat.com,
eparis(a)redhat.com, extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com,
wzheng(a)redhat.com
Target Milestone: ---
Classification: Other
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time
comparison function for validating connection secrets, which could potentially
allow an attacker to use a timing attack to obtain this secret.
References:
https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1659
http://www.openwall.com/lists/oss-security/2020/01/29/1
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1797085] New: CVE-2020-2101 jenkins: Non-constant time comparison of inbound TCP agent connection secret [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1797085
Bug ID: 1797085
Summary: CVE-2020-2101 jenkins: Non-constant time comparison of
inbound TCP agent connection secret [fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: jenkins
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1797071] New: CVE-2020-2102 jenkins: Non-constant time HMAC comparison
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1797071
Bug ID: 1797071
Summary: CVE-2020-2102 jenkins: Non-constant time HMAC
comparison
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: abenaiss(a)redhat.com, adam.kaplan(a)redhat.com,
aos-bugs(a)redhat.com, bmontgom(a)redhat.com,
eparis(a)redhat.com, extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com,
wzheng(a)redhat.com
Target Milestone: ---
Classification: Other
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time
comparison function when validating an HMAC.
References:
https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1660
http://www.openwall.com/lists/oss-security/2020/01/29/1
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1797077] New: CVE-2020-2102 jenkins: Non-constant time HMAC comparison [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1797077
Bug ID: 1797077
Summary: CVE-2020-2102 jenkins: Non-constant time HMAC
comparison [fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: jenkins
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1797063] New: CVE-2020-2103 jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1797063
Bug ID: 1797063
Summary: CVE-2020-2103 jenkins: Exposed session identifiers on
user detail object in the whoAmI diagnostic page
[fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: jenkins
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months