https://bugzilla.redhat.com/show_bug.cgi?id=1205622
Bug ID: 1205622 Summary: CVE-2015-1807 jenkins: directory traversal from artifacts via symlink (SECURITY-162) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: bleanhar@redhat.com, ccoleman@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jdetiber@redhat.com, jialiu@redhat.com, jkeck@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, kseifried@redhat.com, lmeyer@redhat.com, mmccomas@redhat.com, msrb@redhat.com
This vulnerability allows users with the job configuration privilege or users with commit access to the build script to access arbitrary files/directories on the master, resulting in the exposure of sensitive information, such as encryption keys.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-...
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1205634
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1205637
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1205637 [Bug 1205637] CVE-2015-1813 CVE-2015-1812 CVE-2015-1806 CVE-2015-1814 jenkins: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1205638
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
--- Comment #2 from Vasyl Kaigorodov vkaigoro@redhat.com ---
Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1205637]
https://bugzilla.redhat.com/show_bug.cgi?id=1205622 Bug 1205622 depends on bug 1205637, which changed state.
Bug 1205637 Summary: CVE-2015-1806 CVE-2015-1807 CVE-2015-1813 CVE-2015-1812 CVE-2015-1811 CVE-2015-1810 CVE-2015-1808 CVE-2015-1809 CVE-2015-1814 jenkins: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1205637
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
--- Comment #3 from Fedora Update System updates@fedoraproject.org --- jenkins-1.590-3.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
--- Comment #4 from Fedora Update System updates@fedoraproject.org --- jenkins-1.606-1.fc22, jffi-1.2.7-5.fc22, jenkins-executable-war-1.29-4.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1248781
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
--- Doc Text *updated* by Kurt Seifried kseifried@redhat.com --- When building artifacts the Jenkins server may follow symbolic links resulting in disclosure of information on the server.
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
--- Doc Text *updated* by Martin Prpic mprpic@redhat.com --- It was found that when building artifacts, the Jenkins server would follow symbolic links, potentially resulting in disclosure of information on the server.
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015 |0227,reported=20150325,sour |0227,reported=20150325,sour |ce=internet,cvss2=4/AV:N/AC |ce=internet,cvss2=4/AV:N/AC |:L/Au:S/C:P/I:N/A:N,fedora- |:L/Au:S/C:P/I:N/A:N,cwe=CWE |all/jenkins=affected,opensh |-59,fedora-all/jenkins=affe |ift-enterprise-2/jenkins=af |cted,openshift-enterprise-2 |fected,openshift-1/jenkins= |/jenkins=affected,openshift |affected |-1/jenkins=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
--- Comment #7 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHEL 6 Version of OpenShift Enterprise 2.2
Via RHSA-2015:1844 https://rhn.redhat.com/errata/RHSA-2015-1844.html
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2015-09-30 12:43:06
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |NEW Resolution|ERRATA |--- Keywords| |Reopened
https://bugzilla.redhat.com/show_bug.cgi?id=1205622
--- Comment #9 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHEL 7 Version of OpenShift Enterprise 3.1
Via RHSA-2016:0070 https://access.redhat.com/errata/RHSA-2016:0070
java-sig-commits@lists.fedoraproject.org