https://bugzilla.redhat.com/show_bug.cgi?id=1335422
Bug ID: 1335422
Summary: CVE-2016-3727 jenkins: Granting the permission to read
node configurations allows access to overall system
configuration (SECURITY-281)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The API URL /computer/(master)/api/xml allowed users with the 'extended read'
permission for the master node to see some global Jenkins configuration,
including the configuration of the security realm.
This URL now unconditionally sends HTTP 400 Bad Request when accessed. There is
no workaround.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.