https://bugzilla.redhat.com/show_bug.cgi?id=1282359
Bug ID: 1282359
Summary: CVE-2015-5317 jenkins: Project name disclosure via
fingerprints (SECURITY-153)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
The Jenkins UI allowed users to see the names of jobs and builds otherwise
inaccessible to them on the "Fingerprints" pages if those shared file
fingerprints with fingerprinted files in accessible jobs.
Users have no control over which information they see, and the kind of
information revealed is very limited.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=AgVMzmSVXX&a=cc_unsubscribe