https://bugzilla.redhat.com/show_bug.cgi?id=1335427
Bug ID: 1335427
Summary: CVE-2016-3721 CVE-2016-3722 CVE-2016-3723
CVE-2016-3724 CVE-2016-3725 CVE-2016-3726
CVE-2016-3727 jenkins: various flaws [fedora-all]
Product: Fedora
Version: 23
Component: jenkins
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: msrb(a)redhat.com
Reporter: anemec(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Blocks: 1335415 (CVE-2016-3721), 1335416 (CVE-2016-3722),
1335417 (CVE-2016-3723), 1335418 (CVE-2016-3724),
1335420 (CVE-2016-3725), 1335421 (CVE-2016-3726),
1335422 (CVE-2016-3727)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks"
field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1335415
[Bug 1335415] CVE-2016-3721 jenkins: Arbitrary build parameters are passed
to build scripts as environment variables (SECURITY-170)
https://bugzilla.redhat.com/show_bug.cgi?id=1335416
[Bug 1335416] CVE-2016-3722 jenkins: Malicious users with multiple user
accounts can prevent other users from logging in (SECURITY-243)
https://bugzilla.redhat.com/show_bug.cgi?id=1335417
[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins
exposed via API (SECURITY-250)
https://bugzilla.redhat.com/show_bug.cgi?id=1335418
[Bug 1335418] CVE-2016-3724 jenkins: Encrypted secrets (e.g. passwords)
were leaked to users with permission to read configuration (SECURITY-266)
https://bugzilla.redhat.com/show_bug.cgi?id=1335420
[Bug 1335420] CVE-2016-3725 jenkins: Regular users can trigger download of
update site metadata (SECURITY-273)
https://bugzilla.redhat.com/show_bug.cgi?id=1335421
[Bug 1335421] CVE-2016-3726 jenkins: Open redirect to scheme-relative URLs
(SECURITY-276)
https://bugzilla.redhat.com/show_bug.cgi?id=1335422
[Bug 1335422] CVE-2016-3727 jenkins: Granting the permission to read node
configurations allows access to overall system configuration (SECURITY-281)
--
You are receiving this mail because:
You are on the CC list for the bug.