https://bugzilla.redhat.com/show_bug.cgi?id=1291797
Bug ID: 1291797 Summary: CVE-2015-7538 jenkins: CSRF protection ineffective (SECURITY-233) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: mprpic@redhat.com CC: abhgupta@redhat.com, ccoleman@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jialiu@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, kseifried@redhat.com, lmeyer@redhat.com, mizdebsk@redhat.com, mmccomas@redhat.com, msrb@redhat.com, tiwillia@redhat.com
Malicious users were able to circumvent CSRF protection on any URL by sending specially crafted POST requests. This could allow unprivileged attackers to circumvent CSRF protection.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-...
https://bugzilla.redhat.com/show_bug.cgi?id=1291797
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1291799 Depends On| |1291800
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1291799 [Bug 1291799] CVE-2015-7536 CVE-2015-7537 CVE-2015-7538 CVE-2015-7539 jenkins: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1291797
--- Comment #2 from Martin Prpic mprpic@redhat.com ---
Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1291799]
https://bugzilla.redhat.com/show_bug.cgi?id=1291797
--- Comment #4 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHEL 7 Version of OpenShift Enterprise 3.1
Via RHSA-2016:0070 https://access.redhat.com/errata/RHSA-2016:0070
https://bugzilla.redhat.com/show_bug.cgi?id=1291797
--- Comment #5 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Enterprise 2.2
Via RHSA-2016:0489 https://rhn.redhat.com/errata/RHSA-2016-0489.html
https://bugzilla.redhat.com/show_bug.cgi?id=1291797 Bug 1291797 depends on bug 1291799, which changed state.
Bug 1291799 Summary: CVE-2015-7536 CVE-2015-7537 CVE-2015-7538 CVE-2015-7539 jenkins: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1291799
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution|--- |EOL
java-sig-commits@lists.fedoraproject.org