https://bugzilla.redhat.com/show_bug.cgi?id=1185148
Bug ID: 1185148 Summary: CVE-2014-9634 Jenkins on Tomcat: failure to set secure flag on cookies Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: kseifried@redhat.com CC: bleanhar@redhat.com, ccoleman@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jdetiber@redhat.com, jialiu@redhat.com, jkeck@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, kseifried@redhat.com, lmeyer@redhat.com, mmccomas@redhat.com, msrb@redhat.com
Yann Rouillard reports:
Jenkins on Tomcat fails to set the secure flag on cookies.
https://bugzilla.redhat.com/show_bug.cgi?id=1185148
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1169010
https://bugzilla.redhat.com/show_bug.cgi?id=1185148
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1185152 Depends On| |1185153
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1185152 [Bug 1185152] CVE-2014-9634 jenkins: Jenkins on Tomcat: failure to set secure flag on cookies [fedora-21]
https://bugzilla.redhat.com/show_bug.cgi?id=1185148
--- Comment #2 from Kurt Seifried kseifried@redhat.com ---
Created jenkins tracking bugs for this issue:
Affects: fedora-21 [bug 1185152]
https://bugzilla.redhat.com/show_bug.cgi?id=1185148
--- Comment #3 from Kurt Seifried kseifried@redhat.com --- Acknowledgements:
Red Hat would like to thank Yann Rouillard for reporting this issue.
https://bugzilla.redhat.com/show_bug.cgi?id=1185148
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX Last Closed| |2015-01-23 00:26:26
--- Comment #4 from Kurt Seifried kseifried@redhat.com --- Statement:
This issue affects the versions of Jenkins as shipped with Red Hat OpenShift Enterprise 2. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
https://bugzilla.redhat.com/show_bug.cgi?id=1185148
Fedora Java SIG java-sig-commits@lists.fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- CC|java-sig-commits@lists.fedo | |raproject.org |
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141115, |impact=low,public=20141115, |reported=20141128,source=in |reported=20141128,source=up |ternet,cvss2=4.3/AV:N/AC:M/ |stream,cvss2=4.3/AV:N/AC:M/ |Au:N/C:P/I:N/A:N,fedora-21/ |Au:N/C:P/I:N/A:N,fedora-21/ |jenkins=affected,openshift- |jenkins=affected,openshift- |enterprise-2/jenkins=wontfi |enterprise-2/jenkins=wontfi |x,openshift-1/jenkins=affec |x,openshift-1/jenkins=affec |ted |ted
java-sig-commits@lists.fedoraproject.org