https://bugzilla.redhat.com/show_bug.cgi?id=1282362
Bug ID: 1282362 Summary: CVE-2015-5319 jenkins: XXE injection into job configurations via CLI (SECURITY-173) Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: mprpic@redhat.com CC: bleanhar@redhat.com, ccoleman@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jdetiber@redhat.com, jialiu@redhat.com, jkeck@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, kseifried@redhat.com, lmeyer@redhat.com, mizdebsk@redhat.com, mmccomas@redhat.com, msrb@redhat.com
The following flaw was found in Jenkins:
When creating a job using the create-job CLI command, external entities are not discarded (nor processed). If these job configurations are processed by another user with an XML-aware tool (e.g. using get-job/update-job), information from that user's computer may be disclosed to Jenkins and the attacker.
Exploiting this flaw requires a high degree of specific user interaction, and the limited information that can be gained this way.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-...
https://bugzilla.redhat.com/show_bug.cgi?id=1282362
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1282375
https://bugzilla.redhat.com/show_bug.cgi?id=1282362
--- Comment #1 from Martin Prpic mprpic@redhat.com --- Fixed in Fedora in:
jenkins-1.609.3-3.fc22 jenkins-1.625.2-2.fc23 jenkins-1.625.2-2.fc24
https://bugzilla.redhat.com/show_bug.cgi?id=1282362
--- Comment #3 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHEL 7 Version of OpenShift Enterprise 3.1
Via RHSA-2016:0070 https://access.redhat.com/errata/RHSA-2016:0070
https://bugzilla.redhat.com/show_bug.cgi?id=1282362
--- Comment #4 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Enterprise 2.2
Via RHSA-2016:0489 https://rhn.redhat.com/errata/RHSA-2016-0489.html
https://bugzilla.redhat.com/show_bug.cgi?id=1282362
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2016-03-22 15:23:43
java-sig-commits@lists.fedoraproject.org