[Bug 1205615] New: CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

List overview All Threads
Download

newer

older

[Bug 1205616] New: CVE-2015-1814...

[Bug 652183] Java SIG tracker bug

Red Hat Bugzilla

25 Mar 2015 25 Mar '15

5:36 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

Bug ID: 1205615 Summary: CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: bleanhar@redhat.com, ccoleman@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jdetiber@redhat.com, jialiu@redhat.com, jkeck@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, kseifried@redhat.com, lmeyer@redhat.com, mmccomas@redhat.com, msrb@redhat.com

An attacker without any access to Jenkins can navigate the user to a carefully crafted URL and have the user execute unintended actions. This vulnerability can be used to attack Jenkins inside firewalls from outside so long as the location of Jenkins is known to the attacker.

External References:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-...

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=aUngdTWJZ8&a=cc_unsubscribe

Show replies by thread

Red Hat Bugzilla

25 Mar 25 Mar

5:42 a.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

Vasyl Kaigorodov vkaigoro@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=u4klwn3hWM&a=cc_unsubscribe

Red Hat Bugzilla

6:03 a.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1205634

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=dI9dbHUdrP&a=cc_unsubscribe

Red Hat Bugzilla

6:04 a.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

Vasyl Kaigorodov vkaigoro@redhat.com changed:

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1205637 [Bug 1205637] CVE-2015-1813 CVE-2015-1812 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177) [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=I3ZaGGRG8s&a=cc_unsubscribe

Red Hat Bugzilla

6:05 a.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

--- Comment #2 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created jenkins tracking bugs for this issue:

Affects: fedora-all [bug 1205637]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=L9iSiMb9mA&a=cc_unsubscribe

Red Hat Bugzilla

18 Apr 18 Apr

4:43 a.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615 Bug 1205615 depends on bug 1205637, which changed state.

Bug 1205637 Summary: CVE-2015-1806 CVE-2015-1807 CVE-2015-1813 CVE-2015-1812 CVE-2015-1811 CVE-2015-1810 CVE-2015-1808 CVE-2015-1809 CVE-2015-1814 jenkins: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1205637

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=7N4ICtGRIM&a=cc_unsubscribe

Red Hat Bugzilla

4:43 a.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

--- Comment #3 from Fedora Update System updates@fedoraproject.org --- jenkins-1.590-3.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=PWsHH01mv9&a=cc_unsubscribe

Red Hat Bugzilla

21 Apr 21 Apr

2:08 p.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

--- Comment #4 from Fedora Update System updates@fedoraproject.org --- jenkins-1.606-1.fc22, jffi-1.2.7-5.fc22, jenkins-executable-war-1.29-4.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=L3iWP8dPJA&a=cc_unsubscribe

Red Hat Bugzilla

30 Jul 30 Jul

2:56 p.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

Kurt Seifried kseifried@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1248781

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=C4YD6axOux&a=cc_unsubscribe

Red Hat Bugzilla

13 Aug 13 Aug

9:07 p.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

--- Doc Text *updated* by Kurt Seifried kseifried@redhat.com --- Two cross-site scripting (XSS) flaws were found in Jenkins. A remote attacker could use these flaws to conduct XSS attacks against users of an application using Jenkins.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=GgeqsOMprK&a=cc_unsubscribe

Red Hat Bugzilla

10 Sep 10 Sep

6:27 p.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

Kurt Seifried kseifried@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=0CBG3aAnAI&a=cc_unsubscribe _______________________________________________ java-sig-commits mailing list java-sig-commits@lists.fedoraproject.org http://lists.fedoraproject.org/postorius/java-sig-commits@lists.fedoraprojec...

Red Hat Bugzilla

30 Sep 30 Sep

11:36 a.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

--- Comment #7 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

RHEL 6 Version of OpenShift Enterprise 2.2

Via RHSA-2015:1844 https://rhn.redhat.com/errata/RHSA-2015-1844.html

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=lPSJzBWDTO&a=cc_unsubscribe

Red Hat Bugzilla

11:42 a.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

Kurt Seifried kseifried@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=9zSlRv9fUx&a=cc_unsubscribe

Red Hat Bugzilla

11 Jan 11 Jan

6:52 p.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

Kurt Seifried kseifried@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=y6x1y8syFU&a=cc_unsubscribe

Red Hat Bugzilla

26 Jan 26 Jan

1:15 p.m.

New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

https://bugzilla.redhat.com/show_bug.cgi?id=1205615

--- Comment #9 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

RHEL 7 Version of OpenShift Enterprise 3.1

Via RHSA-2016:0070 https://access.redhat.com/errata/RHSA-2016:0070

-- You are receiving this mail because: You are on the CC list for the bug.

3242

Age (days ago)

3549

Last active (days ago)

java-sig-commits@lists.fedoraproject.org

14 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla