https://bugzilla.redhat.com/show_bug.cgi?id=1501820
Bug ID: 1501820 Summary: jenkins: Jenkins core bundled vulnerable version of the commons-httpclient library (SECURITY-555) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: bleanhar@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jkeck@redhat.com, kseifried@redhat.com, mizdebsk@redhat.com, msrb@redhat.com
Jenkins bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks.
External References:
https://jenkins.io/security/advisory/2017-10-11/
https://bugzilla.redhat.com/show_bug.cgi?id=1501820
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1501973
--- Comment #1 from Kurt Seifried kseifried@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: openshift-1 [bug 1501973]
https://bugzilla.redhat.com/show_bug.cgi?id=1501820
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1501826
https://bugzilla.redhat.com/show_bug.cgi?id=1501820
Brenton Leanhardt bleanhar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(kseifried@redhat. | |com)
https://bugzilla.redhat.com/show_bug.cgi?id=1501820
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(kseifried@redhat. | |com) |
https://bugzilla.redhat.com/show_bug.cgi?id=1501820
Brenton Leanhardt bleanhar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(kseifried@redhat. | |com)
https://bugzilla.redhat.com/show_bug.cgi?id=1501820
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(kseifried@redhat. | |com) |
https://bugzilla.redhat.com/show_bug.cgi?id=1501820
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|jenkins: Jenkins core |CVE-2017-1000396 jenkins: |bundled vulnerable version |Jenkins core bundled |of the commons-httpclient |vulnerable version of the |library (SECURITY-555) |commons-httpclient library | |(SECURITY-555) Alias| |CVE-2017-1000396
https://bugzilla.redhat.com/show_bug.cgi?id=1501820
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ahardin@redhat.com, | |dbaker@redhat.com, | |jokerman@redhat.com, | |mchappel@redhat.com Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |1011,reported=20171011,sour |1011,reported=20171011,sour |ce=internet,cvss3=4.8/CVSS: |ce=internet,cvss3=4.8/CVSS: |3.0/AV:N/AC:H/PR:N/UI:N/S:U |3.0/AV:N/AC:H/PR:N/UI:N/S:U |/C:L/I:L/A:N,cwe=CWE-300,op |/C:L/I:L/A:N,cwe=CWE-300,op |enshift-enterprise-3/jenkin |enshift-enterprise-3/jenkin |s=new,openshift-1/jenkins=a |s=affected,openshift-1/jenk |ffected,fedora-all/jenkins= |ins=affected,fedora-all/jen |affected |kins=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1501820
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1558858, 1558857
--- Comment #10 from Jason Shepherd jshepherd@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1558858]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1558858 [Bug 1558858] CVE-2017-1000396 jenkins: Jenkins core bundled vulnerable version of the commons-httpclient library (SECURITY-555) [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1501820
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |1011,reported=20171011,sour |1011,reported=20171011,sour |ce=internet,cvss3=4.8/CVSS: |ce=internet,cvss3=4.8/CVSS: |3.0/AV:N/AC:H/PR:N/UI:N/S:U |3.0/AV:N/AC:H/PR:N/UI:N/S:U |/C:L/I:L/A:N,cwe=CWE-300,op |/C:L/I:L/A:N,cwe=CWE-300,op |enshift-enterprise-3/jenkin |enshift-enterprise-3/jenkin |s=affected,openshift-1/jenk |s=notaffected,openshift-1/j |ins=affected,fedora-all/jen |enkins=notaffected,fedora-a |kins=affected |ll/jenkins=affected
--- Comment #12 from Jason Shepherd jshepherd@redhat.com --- Openshift is now using Jenkins version 2.83.2. Marking both Online and Enterprise as not affected.
java-sig-commits@lists.fedoraproject.org