https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Bug ID: 1501813 Summary: jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: bleanhar@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jkeck@redhat.com, kseifried@redhat.com, mizdebsk@redhat.com, msrb@redhat.com
Jenkins bundled a version of the commons-fileupload library with the denial-of-service vulnerability known as CVE-2016-3092.
External References:
https://jenkins.io/security/advisory/2017-10-11/
https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1501826
https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1501968
--- Comment #1 from Kurt Seifried kseifried@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: openshift-1 [bug 1501968]
https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Mark Knowles mknowles@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |71011,reported=20171011,sou |71011,reported=20171011,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,cwe=CWE-400,o |U/C:N/I:N/A:H,cwe=CWE-400,o |penshift-enterprise-3/jenki |penshift-enterprise-3/jenki |ns=new,openshift-1/jenkins= |ns=affected,openshift-1/jen |affected,fedora-all/jenkins |kins=affected,fedora-all/je |=affected |nkins=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Mark Knowles mknowles@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1515069, 1515068
--- Comment #2 from Mark Knowles mknowles@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1515068]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1515068 [Bug 1515068] jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490) [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|jenkins: Jenkins core |CVE-2017-1000394 jenkins: |bundled vulnerable version |Jenkins core bundled |of the commons-fileupload |vulnerable version of the |library (SECURITY-490) |commons-fileupload library | |(SECURITY-490) Alias| |CVE-2017-1000394
https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ahardin@redhat.com, | |dbaker@redhat.com, | |jokerman@redhat.com, | |mchappel@redhat.com Whiteboard|impact=important,public=201 |impact=important,public=201 |71011,reported=20171011,sou |71011,reported=20171011,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,cwe=CWE-400,o |U/C:N/I:N/A:H,cwe=CWE-400,o |penshift-enterprise-3/jenki |penshift-enterprise-3/jenki |ns=affected,openshift-1/jen |ns=notaffected,openshift-1/ |kins=affected,fedora-all/je |jenkins=affected,fedora-all |nkins=affected |/jenkins=affected
--- Comment #4 from Jason Shepherd jshepherd@redhat.com --- openshift3/jenkins-2-rhel7 now uses version 2.89.2
Marking Openshift Enteprise 3 as not affected.
java-sig-commits@lists.fedoraproject.org