https://bugzilla.redhat.com/show_bug.cgi?id=1291794
Bug ID: 1291794 Summary: CVE-2015-7536 jenkins: stored XSS vulnerability through workspace files and archived artifacts (SECURITY-95) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: mprpic@redhat.com CC: abhgupta@redhat.com, ccoleman@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jialiu@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, kseifried@redhat.com, lmeyer@redhat.com, mizdebsk@redhat.com, mmccomas@redhat.com, msrb@redhat.com, tiwillia@redhat.com
In certain configurations, low privilege users were able to create e.g. HTML files in workspaces and archived artifacts that could result in XSS when accessed by other users. Jenkins now sends Content-Security-Policy headers that enables sandboxing and prohibits script execution by default.
This could allow low-privilege users to perform limited XSS in certain configurations.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-...
https://bugzilla.redhat.com/show_bug.cgi?id=1291794
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1291799 Depends On| |1291800
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1291799 [Bug 1291799] CVE-2015-7536 CVE-2015-7537 CVE-2015-7538 CVE-2015-7539 jenkins: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1291794
--- Comment #2 from Martin Prpic mprpic@redhat.com ---
Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1291799]
https://bugzilla.redhat.com/show_bug.cgi?id=1291794 Bug 1291794 depends on bug 1291799, which changed state.
Bug 1291799 Summary: CVE-2015-7536 CVE-2015-7537 CVE-2015-7538 CVE-2015-7539 jenkins: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1291799
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution|--- |EOL
java-sig-commits@lists.fedoraproject.org