https://bugzilla.redhat.com/show_bug.cgi?id=1291798
Bug ID: 1291798 Summary: CVE-2015-7539 jenkins: Jenkins plugin manager vulnerable to MITM attacks (SECURITY-234) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: mprpic@redhat.com CC: abhgupta@redhat.com, ccoleman@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jialiu@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, kseifried@redhat.com, lmeyer@redhat.com, mizdebsk@redhat.com, mmccomas@redhat.com, msrb@redhat.com, tiwillia@redhat.com
While the Jenkins update site data is digitally signed, and the signature verified by Jenkins, Jenkins did not verify the provided SHA-1 checksums for the plugin files referenced in the update site data. This enabled MITM attacks on the plugin manager, resulting in installation of attacker-provided plugins.
This could allow attackers able to manipulate the network path between Jenkins and the update site to install and run arbitrary code on Jenkins.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-...
https://bugzilla.redhat.com/show_bug.cgi?id=1291798
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1291799 Depends On| |1291800
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1291799 [Bug 1291799] CVE-2015-7536 CVE-2015-7537 CVE-2015-7538 CVE-2015-7539 jenkins: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1291798
--- Comment #2 from Martin Prpic mprpic@redhat.com ---
Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1291799]
https://bugzilla.redhat.com/show_bug.cgi?id=1291798
--- Comment #4 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHEL 7 Version of OpenShift Enterprise 3.1
Via RHSA-2016:0070 https://access.redhat.com/errata/RHSA-2016:0070
https://bugzilla.redhat.com/show_bug.cgi?id=1291798
--- Comment #5 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Enterprise 2.2
Via RHSA-2016:0489 https://rhn.redhat.com/errata/RHSA-2016-0489.html
https://bugzilla.redhat.com/show_bug.cgi?id=1291798 Bug 1291798 depends on bug 1291799, which changed state.
Bug 1291799 Summary: CVE-2015-7536 CVE-2015-7537 CVE-2015-7538 CVE-2015-7539 jenkins: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1291799
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution|--- |EOL
java-sig-commits@lists.fedoraproject.org