https://bugzilla.redhat.com/show_bug.cgi?id=1446110
Bug ID: 1446110
Summary: CVE-2017-1000356 jenkins: Multiple CSRF
vulnerabilities (SECURITY-412 through SECURITY-420)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
Multiple Cross-Site Request Forgery vulnerabilities in Jenkins allowed
malicious users to perform several administrative actions by tricking a victim
into opening a web page. The most notable ones:
SECURITY-412: Restart Jenkins immediately, after all builds are finished,
or after all plugin installations and builds are finished
SECURITY-412: Schedule a downgrade of Jenkins to a previously installed
version if Jenkins previously upgraded itself
SECURITY-413: Install and (optionally) dynamically load any plugin present
on a configured update site
SECURITY-414: Remove any update site from the Jenkins configuration
SECURITY-415: Change a user’s API token
SECURITY-416: Submit system configuration
SECURITY-417: Submit global security configuration
SECURITY-418, SECURITY-420: For Jenkins user database authentication realm:
create an account if signup is enabled; or create an account if the victim is
an administrator, possibly deleting the existing default admin user in the
process
SECURITY-419: Create a new agent, possibly executing arbitrary shell
commands on the master node by choosing the appropriate launch method
SECURITY-420: Cancel a scheduled restart
SECURITY-420: Configure the global logging levels
SECURITY-420: Create a copy of an existing agent
SECURITY-420: Create copies of views in users' "My Views" or as children
of
the experimental "Tree View" feature
SECURITY-420: Enter "quiet down" mode in which no new builds are started
SECURITY-420: On Windows, after successful installation as a service,
restart
SECURITY-420: On Windows, try to install Jenkins as a service
SECURITY-420: Set the descriptions of items (jobs), builds, and users
SECURITY-420: Submit global tools configuration (Jenkins 2.0 and up)
SECURITY-420: Toggle keeping a build forever (i.e. exclude or include it in
log rotation)
SECURITY-420: Try to connect all disconnected agents simultaneously
SECURITY-420: Update the node monitor data on all agents
Affected versions:
All Jenkins main line releases up to and including 2.56
All Jenkins LTS releases up to and including 2.46.1
Fixed in:
Jenkins main line users should update to 2.57
Jenkins LTS users should update to 2.46.2
External Reference:
https://jenkins.io/security/advisory/2017-04-26/
--
You are receiving this mail because:
You are on the CC list for the bug.