https://bugzilla.redhat.com/show_bug.cgi?id=1501819
Bug ID: 1501819 Summary: jenkins: Form validation for password fields was sent via GET (SECURITY-616) Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: bleanhar@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jkeck@redhat.com, kseifried@redhat.com, mizdebsk@redhat.com, msrb@redhat.com
The Jenkins default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations of Jenkins, and made available to users with access to these log files.
External References:
https://jenkins.io/security/advisory/2017-10-11/
https://bugzilla.redhat.com/show_bug.cgi?id=1501819
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1501826
https://bugzilla.redhat.com/show_bug.cgi?id=1501819
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1501972
--- Comment #1 from Kurt Seifried kseifried@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: openshift-1 [bug 1501972]
https://bugzilla.redhat.com/show_bug.cgi?id=1501819
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|jenkins: Form validation |CVE-2017-1000401 jenkins: |for password fields was |Form validation for |sent via GET (SECURITY-616) |password fields was sent | |via GET (SECURITY-616) Alias| |CVE-2017-1000401
https://bugzilla.redhat.com/show_bug.cgi?id=1501819
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ahardin@redhat.com, | |dbaker@redhat.com, | |jokerman@redhat.com, | |mchappel@redhat.com Whiteboard|impact=low,public=20171011, |impact=low,public=20171011, |reported=20171011,source=in |reported=20171011,source=in |ternet,cvss3=2.2/CVSS:3.0/A |ternet,cvss3=2.2/CVSS:3.0/A |V:L/AC:H/PR:L/UI:R/S:U/C:L/ |V:L/AC:H/PR:L/UI:R/S:U/C:L/ |I:N/A:N,cwe=CWE-532,openshi |I:N/A:N,cwe=CWE-532,openshi |ft-enterprise-3/jenkins=new |ft-enterprise-3/jenkins=aff |,openshift-1/jenkins=affect |ected,openshift-1/jenkins=a |ed,fedora-all/jenkins=affec |ffected,fedora-all/jenkins= |ted |affected
https://bugzilla.redhat.com/show_bug.cgi?id=1501819
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1558869, 1558870
--- Comment #2 from Jason Shepherd jshepherd@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1558869]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1558869 [Bug 1558869] CVE-2017-1000401 jenkins: Form validation for password fields was sent via GET (SECURITY-616) [fedora-all]
java-sig-commits@lists.fedoraproject.org