https://bugzilla.redhat.com/show_bug.cgi?id=1418711
Bug ID: 1418711 Summary: CVE-2017-2602 jenkins: Pipeline metadata files not blacklisted in agent-to-master security subsystem (SECURITY-358) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: anemec@redhat.com CC: abhgupta@redhat.com, bleanhar@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jkeck@redhat.com, joelsmith@redhat.com, kseifried@redhat.com, mizdebsk@redhat.com, msrb@redhat.com, tdawson@redhat.com, tiwillia@redhat.com
The following flaw was found in Jenkins:
The Pipeline suite of plugins stored build metadata in the file program.dat and the directory workflow/. These were not blacklisted in the agent-to-master security subsystem and could therefore be written to by malicious agents.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-...
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/414ff7e30aba66bed18c4ee8a8660fb3...
https://bugzilla.redhat.com/show_bug.cgi?id=1418711
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |jenkins 2.44, jenkins | |2.32.2
https://bugzilla.redhat.com/show_bug.cgi?id=1418711
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |low Whiteboard|impact=moderate,public=2017 |impact=low,public=20170201, |0201,reported=20170125,sour |reported=20170125,source=di |ce=distros,cvss3=3.1/CVSS:3 |stros,cvss3=3.1/CVSS:3.0/AV |.0/AV:N/AC:H/PR:L/UI:N/S:U/ |:N/AC:H/PR:L/UI:N/S:U/C:N/I |C:N/I:L/A:N,fedora-all/jenk |:L/A:N,fedora-all/jenkins=a |ins=affected,openshift-ente |ffected,openshift-enterpris |rprise-3/jenkins=new,opensh |e-3/jenkins=new,openshift-e |ift-enterprise-2/jenkins=ne |nterprise-2/jenkins=new |w | Severity|medium |low
https://bugzilla.redhat.com/show_bug.cgi?id=1418711
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1418735 Depends On| |1418736
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1418736 [Bug 1418736] CVE-2017-2598 CVE-2017-2599 CVE-2017-2600 CVE-2017-2601 CVE-2017-2602 CVE-2017-2604 CVE-2017-2605 CVE-2017-2606 CVE-2017-2607 CVE-2017-2608 CVE-2017-2609 CVE-2017-2610 CVE-2017-2611 CVE-2017-2612 CVE-2017-2613 jenkins: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1418711
--- Comment #1 from Andrej Nemec anemec@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1418736]
https://bugzilla.redhat.com/show_bug.cgi?id=1418711
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1395176
https://bugzilla.redhat.com/show_bug.cgi?id=1418711
Laura Pardo lpardo@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20170201, |impact=low,public=20170201, |reported=20170125,source=di |reported=20170125,source=di |stros,cvss3=3.1/CVSS:3.0/AV |stros,cvss3=3.1/CVSS:3.0/AV |:N/AC:H/PR:L/UI:N/S:U/C:N/I |:N/AC:H/PR:L/UI:N/S:U/C:N/I |:L/A:N,fedora-all/jenkins=a |:L/A:N,cwe=CWE-184,fedora-a |ffected,openshift-enterpris |ll/jenkins=affected,openshi |e-3/jenkins=new,openshift-e |ft-enterprise-3/jenkins=new |nterprise-2/jenkins=new |,openshift-enterprise-2/jen | |kins=new
java-sig-commits@lists.fedoraproject.org