https://bugzilla.redhat.com/show_bug.cgi?id=1185151
Bug ID: 1185151 Summary: CVE-2014-9635 Jenkins on Tomcat: failure to set httponly flag on cookies Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: kseifried@redhat.com CC: bleanhar@redhat.com, ccoleman@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jdetiber@redhat.com, jialiu@redhat.com, jkeck@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, kseifried@redhat.com, lmeyer@redhat.com, mmccomas@redhat.com, msrb@redhat.com
Yann Rouillard reports:
Jenkins on Tomcat fails to set the httponly flag on cookies.
https://bugzilla.redhat.com/show_bug.cgi?id=1185151
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1169010
https://bugzilla.redhat.com/show_bug.cgi?id=1185151
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1185152
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1185152 [Bug 1185152] CVE-2014-9634 jenkins: Jenkins on Tomcat: failure to set secure flag on cookies [fedora-21]
https://bugzilla.redhat.com/show_bug.cgi?id=1185151
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1185153
https://bugzilla.redhat.com/show_bug.cgi?id=1185151
--- Comment #2 from Kurt Seifried kseifried@redhat.com ---
Created jenkins tracking bugs for this issue:
Affects: fedora-21 [bug 1185152]
https://bugzilla.redhat.com/show_bug.cgi?id=1185151
--- Comment #3 from Kurt Seifried kseifried@redhat.com --- Acknowledgements:
Red Hat would like to thank Yann Rouillard for reporting this issue.
https://bugzilla.redhat.com/show_bug.cgi?id=1185151
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX Last Closed| |2015-01-23 00:26:33
--- Comment #4 from Kurt Seifried kseifried@redhat.com --- Statement:
This issue affects the versions of Jenkins as shipped with Red Hat OpenShift Enterprise 2. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
https://bugzilla.redhat.com/show_bug.cgi?id=1185151
Fedora Java SIG java-sig-commits@lists.fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- CC|java-sig-commits@lists.fedo | |raproject.org |
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141115, |impact=low,public=20141115, |reported=20141128,source=in |reported=20141128,source=de |ternet,cvss2=4.3/AV:N/AC:M/ |bian,cvss2=4.3/AV:N/AC:M/Au |Au:N/C:P/I:N/A:N,fedora-21/ |:N/C:P/I:N/A:N,fedora-21/je |jenkins=affected,openshift- |nkins=affected,openshift-en |enterprise-2/jenkins=wontfi |terprise-2/jenkins=wontfix, |x,openshift-1/jenkins=affec |openshift-1/jenkins=affecte |ted |d
java-sig-commits@lists.fedoraproject.org