https://bugzilla.redhat.com/show_bug.cgi?id=1730869
Bug ID: 1730869 Summary: CVE-2019-10354 jenkins: Unauthorized view fragment access (SECURITY-534) Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=moderate,public=20190717,reported=20190717,sour ce=internet,cvss3=4.3/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U /C:L/I:N/A:N,cwe=CWE-200,openshift-enterprise-3.6/jenk ins=new,openshift-enterprise-3.7/jenkins=new,openshift -enterprise-3.9/jenkins=new,openshift-enterprise-3.10/ jenkins=new,openshift-enterprise-3.11/jenkins=new,open shift-enterprise-4.1/jenkins=new,fedora-all/jenkins=af fected Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: lpardo@redhat.com CC: abenaiss@redhat.com, adam.kaplan@redhat.com, ahardin@redhat.com, aos-bugs@redhat.com, bleanhar@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, eparis@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jokerman@redhat.com, mchappel@redhat.com, mizdebsk@redhat.com, msrb@redhat.com, vbobade@redhat.com, wzheng@redhat.com Target Milestone: --- Classification: Other
A vulnerability was found in Jenkins versions weekly before 2.186 and LTS before 2.176.2. Jenkins uses the Stapler web framework to render its UI views. These views are frequently comprised of several view fragments, enabling plugins to extend existing views with more content. In some cases attackers could directly access a view fragment containing sensitive information, bypassing any permission checks in the corresponding view.
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
--- Comment #1 from Laura Pardo lpardo@redhat.com --- External References:
https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
Laura Pardo lpardo@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1730876
--- Comment #2 from Laura Pardo lpardo@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1730876]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1730876 [Bug 1730876] CVE-2019-10354 jenkins: Unauthorized view fragment access (SECURITY-534) [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
Laura Pardo lpardo@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1730879
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2019 |impact=moderate,public=2019 |0717,reported=20190717,sour |0717,reported=20190717,sour |ce=internet,cvss3=4.3/CVSS: |ce=internet,cvss3=4.3/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U |/C:L/I:N/A:N,cwe=CWE-200,op |/C:L/I:N/A:N,cwe=CWE-200,op |enshift-enterprise-3.6/jenk |enshift-enterprise-3.6/jenk |ins=new,openshift-enterpris |ins=new,openshift-enterpris |e-3.7/jenkins=new,openshift |e-3.7/jenkins=new,openshift |-enterprise-3.9/jenkins=new |-enterprise-3.9/jenkins=new |,openshift-enterprise-3.10/ |,openshift-enterprise-3.10/ |jenkins=new,openshift-enter |jenkins=new,openshift-enter |prise-3.11/jenkins=new,open |prise-3.11/jenkins=new,open |shift-enterprise-4.1/jenkin |shift-enterprise-4.1/jenkin |s=new,fedora-all/jenkins=af |s=affected,fedora-all/jenki |fected |ns=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1731021
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2019 |impact=moderate,public=2019 |0717,reported=20190717,sour |0717,reported=20190717,sour |ce=internet,cvss3=4.3/CVSS: |ce=internet,cvss3=4.3/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U |/C:L/I:N/A:N,cwe=CWE-200,op |/C:L/I:N/A:N,cwe=CWE-200,op |enshift-enterprise-3.6/jenk |enshift-enterprise-3.6/jenk |ins=new,openshift-enterpris |ins=new,openshift-enterpris |e-3.7/jenkins=new,openshift |e-3.7/jenkins=new,openshift |-enterprise-3.9/jenkins=new |-enterprise-3.9/jenkins=new |,openshift-enterprise-3.10/ |,openshift-enterprise-3.10/ |jenkins=new,openshift-enter |jenkins=new,openshift-enter |prise-3.11/jenkins=new,open |prise-3.11/jenkins=affected |shift-enterprise-4.1/jenkin |,openshift-enterprise-4.1/j |s=affected,fedora-all/jenki |enkins=affected,fedora-all/ |ns=affected |jenkins=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1731024
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2019 |impact=moderate,public=2019 |0717,reported=20190717,sour |0717,reported=20190717,sour |ce=internet,cvss3=4.3/CVSS: |ce=internet,cvss3=4.3/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U |/C:L/I:N/A:N,cwe=CWE-200,op |/C:L/I:N/A:N,cwe=CWE-200,op |enshift-enterprise-3.6/jenk |enshift-enterprise-3.6/jenk |ins=new,openshift-enterpris |ins=wontfix,openshift-enter |e-3.7/jenkins=new,openshift |prise-3.7/jenkins=wontfix,o |-enterprise-3.9/jenkins=new |penshift-enterprise-3.9/jen |,openshift-enterprise-3.10/ |kins=wontfix,openshift-ente |jenkins=new,openshift-enter |rprise-3.10/jenkins=wontfix |prise-3.11/jenkins=affected |,openshift-enterprise-3.11/ |,openshift-enterprise-4.1/j |jenkins=affected,openshift- |enkins=affected,fedora-all/ |enterprise-4.1/jenkins=affe |jenkins=affected |cted,fedora-all/jenkins=aff | |ected
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
--- Comment #5 from Sam Fowler sfowler@redhat.com --- "Any security advisory related updates to Jenkins core or the plugins we include in the OpenShift Jenkins master image will only occur in the v3.11 and v4.x branches of this repository."
https://github.com/openshift/jenkins/blob/master/README.md#jenkins-security-...
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
Akram Ben Aissi abenaiss@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1731034
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2019 |impact=moderate,public=2019 |0717,reported=20190717,sour |0717,reported=20190717,sour |ce=internet,cvss3=4.3/CVSS: |ce=internet,cvss3=4.3/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U |/C:L/I:N/A:N,cwe=CWE-200,op |/C:L/I:N/A:N,cwe=CWE-200,op |enshift-enterprise-3.6/jenk |enshift-enterprise-3.6/jenk |ins=wontfix,openshift-enter |ins=wontfix,openshift-enter |prise-3.7/jenkins=wontfix,o |prise-3.7/jenkins=wontfix,o |penshift-enterprise-3.9/jen |penshift-enterprise-3.9/jen |kins=wontfix,openshift-ente |kins=wontfix,openshift-ente |rprise-3.10/jenkins=wontfix |rprise-3.10/jenkins=wontfix |,openshift-enterprise-3.11/ |,openshift-enterprise-3.11/ |jenkins=affected,openshift- |jenkins=affected,openshift- |enterprise-4.1/jenkins=affe |enterprise-4.1/jenkins=affe |cted,fedora-all/jenkins=aff |cted,fedora-all/jenkins=aff |ected |ected,openshift-4.2/jenkins | |=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
--- Comment #6 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 3.11
Via RHSA-2019:2503 https://access.redhat.com/errata/RHSA-2019:2503
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2503
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2019-08-15 14:47:05
--- Comment #7 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2019-10354
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
--- Comment #8 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.1
Via RHSA-2019:2548 https://access.redhat.com/errata/RHSA-2019:2548
https://bugzilla.redhat.com/show_bug.cgi?id=1730869
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2548
https://bugzilla.redhat.com/show_bug.cgi?id=1730869 Bug 1730869 depends on bug 1730876, which changed state.
Bug 1730876 Summary: CVE-2019-10354 jenkins: Unauthorized view fragment access (SECURITY-534) [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1730876
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
java-sig-commits@lists.fedoraproject.org