[Bug 1335417] New: CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

Bug ID: 1335417
           Summary: CVE-2016-3723 jenkins: Information on installed
                    plugins exposed via API (SECURITY-250)
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]

The following flaw was found in Jenkins:

The XML/JSON API endpoints providing information about installed plugins were
missing permissions checks, allowing any user with read access to Jenkins to
determine which plugins and versions were installed.

External References:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-...

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

Andrej Nemec  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1335425

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

Andrej Nemec  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1335427

--- Comment #1 from Andrej Nemec  ---

Created jenkins tracking bugs for this issue:

Affects: fedora-all [bug 1335427]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1335427
[Bug 1335427] CVE-2016-3721 CVE-2016-3722 CVE-2016-3723 CVE-2016-3724
CVE-2016-3725 CVE-2016-3726 CVE-2016-3727 jenkins: various flaws
[fedora-all]

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

--- Comment #2 from Fedora Update System  ---
jenkins-1.651.2-1.fc24 has been pushed to the Fedora 24 stable repository. If
problems still persist, please make note of it in this bug report.

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417
Bug 1335417 depends on bug 1335427, which changed state.

Bug 1335427 Summary: CVE-2016-3721 CVE-2016-3722 CVE-2016-3723 CVE-2016-3724 CVE-2016-3725 CVE-2016-3726 CVE-2016-3727 jenkins: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1335427

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

--- Comment #3 from Fedora Update System  ---
jenkins-1.625.3-4.fc23 has been pushed to the Fedora 23 stable repository. If
problems still persist, please make note of it in this bug report.

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

--- Comment #4 from Fedora Update System  ---
jenkins-1.609.3-7.fc22 has been pushed to the Fedora 22 stable repository. If
problems still persist, please make note of it in this bug report.

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

--- Comment #5 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat OpenShift Enterprise 3.2
  Red Hat OpenShift Enterprise 3.1

Via RHSA-2016:1206 https://access.redhat.com/errata/RHSA-2016:1206

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

Kurt Seifried  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |ERRATA
        Last Closed|                            |2016-06-06 15:13:59

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

Kurt Seifried  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1349611

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

--- Comment #7 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat OpenShift Enterprise 2.2

Via RHSA-2016:1773 https://rhn.redhat.com/errata/RHSA-2016-1773.html