https://bugzilla.redhat.com/show_bug.cgi?id=1282371
Bug ID: 1282371 Summary: jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: mprpic@redhat.com CC: bleanhar@redhat.com, ccoleman@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jdetiber@redhat.com, jialiu@redhat.com, jkeck@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, kseifried@redhat.com, lmeyer@redhat.com, mizdebsk@redhat.com, mmccomas@redhat.com, msrb@redhat.com
The following flaw was found in Jenkins:
Unsafe deserialization allows unauthenticated remote attackers to run arbitrary code on the Jenkins master.
This flaw could allow unauthenticated remote attackers to run arbitrary code on Jenkins.
Mitigation:
https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execut...
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-...
https://bugzilla.redhat.com/show_bug.cgi?id=1282371
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1282375
https://bugzilla.redhat.com/show_bug.cgi?id=1282371
--- Comment #1 from Martin Prpic mprpic@redhat.com --- Fixed in Fedora in:
jenkins-1.609.3-3.fc22 jenkins-1.625.2-2.fc23 jenkins-1.625.2-2.fc24
https://bugzilla.redhat.com/show_bug.cgi?id=1282371
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |amaris@redhat.com Summary|jenkins: Remote code |CVE-2015-8103 jenkins: |execution vulnerability due |Remote code execution |to unsafe deserialization |vulnerability due to unsafe |in Jenkins remoting |deserialization in Jenkins |(SECURITY-218) |remoting (SECURITY-218) Alias| |CVE-2015-8103
--- Comment #2 from Adam Mariš amaris@redhat.com --- CVE assignment:
http://seclists.org/oss-sec/2015/q4/307
https://bugzilla.redhat.com/show_bug.cgi?id=1282371
--- Comment #4 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHEL 7 Version of OpenShift Enterprise 3.1
Via RHSA-2016:0070 https://access.redhat.com/errata/RHSA-2016:0070
https://bugzilla.redhat.com/show_bug.cgi?id=1282371
--- Comment #5 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Enterprise 2.2
Via RHSA-2016:0489 https://rhn.redhat.com/errata/RHSA-2016-0489.html
https://bugzilla.redhat.com/show_bug.cgi?id=1282371
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2016-03-22 15:24:26
https://bugzilla.redhat.com/show_bug.cgi?id=1282371
Ján Rusnačko jrusnack@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |jrusnack@redhat.com Whiteboard|impact=important,public=201 |impact=important,public=201 |51111,reported=20151111,sou |51111,reported=20151111,sou |rce=internet,cvss2=6.8/AV:N |rce=internet,cvss2=6.8/AV:N |/AC:M/Au:N/C:P/I:P/A:P,fedo |/AC:M/Au:N/C:P/I:P/A:P,fedo |ra-all/jenkins=affected,ope |ra-all/jenkins=affected,ope |nshift-enterprise-2/jenkins |nshift-enterprise-2/jenkins |=affected,openshift-1/jenki |=affected,openshift-1/jenki |ns=affected |ns=affected,cwe=CWE-502
java-sig-commits@lists.fedoraproject.org