java-sig-commits March 2016

java-sig-commits@lists.fedoraproject.org

3 participants
219 discussions

[Bug 1282366] New: CVE-2015-5323 jenkins: API tokens of other users available to admins (SECURITY-200)
by Red Hat Bugzilla 22 Mar '16

22 Mar '16

https://bugzilla.redhat.com/show_bug.cgi?id=1282366 Bug ID: 1282366 Summary: CVE-2015-5323 jenkins: API tokens of other users available to admins (SECURITY-200) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: mprpic(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mizdebsk(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com The following flaw was found in Jenkins: API tokens of other users were exposed to admins by default. On instances that don't implicitly grant RunScripts permission to admins, this allowed admins to run scripts with another user's credentials. In very specific circumstances, it allows admins to gain permissions they would not otherwise have. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ZqXJZdyVqX&a=cc_unsubscribe

1 5

[Bug 1282365] New: CVE-2015-5322 jenkins: Local file inclusion vulnerability (SECURITY-195)
by Red Hat Bugzilla 22 Mar '16

22 Mar '16

https://bugzilla.redhat.com/show_bug.cgi?id=1282365 Bug ID: 1282365 Summary: CVE-2015-5322 jenkins: Local file inclusion vulnerability (SECURITY-195) Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: mprpic(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mizdebsk(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com The following flaw was found in Jenkins: Access to the /jnlpJars/ URL was not limited to the specific JAR files users needed to access, allowing browsing directories and downloading other files in the Jenkins servlet resources, such as web.xml. The information gained is very limited, and it requires a specific setup to gain any non-public information this way. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IMdsIBEfX4&a=cc_unsubscribe

1 5

[Bug 1282364] New: CVE-2015-5321 jenkins: Information disclosure via sidepanel (SECURITY-192)
by Red Hat Bugzilla 22 Mar '16

22 Mar '16

https://bugzilla.redhat.com/show_bug.cgi?id=1282364 Bug ID: 1282364 Summary: CVE-2015-5321 jenkins: Information disclosure via sidepanel (SECURITY-192) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: mprpic(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mizdebsk(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com The following flaw was found in Jenkins: The CLI command overview and help pages in Jenkins were accessible without Overall/Read permission, resulting in disclosure of the names of configured slaves (and contents of other sidepanel widgets, if present) to unauthorized users. While the amount of information disclosed is very limited, it is trivial to exploit this flaw. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=qw4nbq3cTD&a=cc_unsubscribe

1 5

[Bug 1282363] New: CVE-2015-5320 jenkins: Secret key not verified when connecting a slave (SECURITY-184)
by Red Hat Bugzilla 22 Mar '16

22 Mar '16

https://bugzilla.redhat.com/show_bug.cgi?id=1282363 Bug ID: 1282363 Summary: CVE-2015-5320 jenkins: Secret key not verified when connecting a slave (SECURITY-184) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: mprpic(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mizdebsk(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com The following flaw was found in Jenkins: JNLP slave connections did not verify that the correct secret was supplied, which allowed malicious users to connect their own machines as slaves to Jenkins knowing only the name of the slave. This enables attackers to take over Jenkins (unless the slave-to-master security subsystem is enabled) or gain access to private data like keys and source code. This issue allowos for several different attacks, compromising integrity, stability and confidentiality. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=iMwUEXpAua&a=cc_unsubscribe

1 5

[Bug 1282362] New: CVE-2015-5319 jenkins: XXE injection into job configurations via CLI (SECURITY-173)
by Red Hat Bugzilla 22 Mar '16

22 Mar '16

https://bugzilla.redhat.com/show_bug.cgi?id=1282362 Bug ID: 1282362 Summary: CVE-2015-5319 jenkins: XXE injection into job configurations via CLI (SECURITY-173) Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: mprpic(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mizdebsk(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com The following flaw was found in Jenkins: When creating a job using the create-job CLI command, external entities are not discarded (nor processed). If these job configurations are processed by another user with an XML-aware tool (e.g. using get-job/update-job), information from that user's computer may be disclosed to Jenkins and the attacker. Exploiting this flaw requires a high degree of specific user interaction, and the limited information that can be gained this way. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=lo259rTqud&a=cc_unsubscribe

1 5

[Bug 1282359] New: CVE-2015-5317 jenkins: Project name disclosure via fingerprints (SECURITY-153)
by Red Hat Bugzilla 22 Mar '16

22 Mar '16

https://bugzilla.redhat.com/show_bug.cgi?id=1282359 Bug ID: 1282359 Summary: CVE-2015-5317 jenkins: Project name disclosure via fingerprints (SECURITY-153) Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: mprpic(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mizdebsk(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com The following flaw was found in Jenkins: The Jenkins UI allowed users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages if those shared file fingerprints with fingerprinted files in accessible jobs. Users have no control over which information they see, and the kind of information revealed is very limited. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AgVMzmSVXX&a=cc_unsubscribe

1 5

[Bug 652183] Java SIG tracker bug
by Red Hat Bugzilla 22 Mar '16

22 Mar '16

https://bugzilla.redhat.com/show_bug.cgi?id=652183 Bug 652183 depends on bug 1316196, which changed state. Bug 1316196 Summary: Review Request: shrinkwrap-resolver - ShrinkWrap Resolver https://bugzilla.redhat.com/show_bug.cgi?id=1316196 What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution|--- |NOTABUG -- You are receiving this mail because: You are the QA Contact for the bug. You are the assignee for the bug.

1 0

[Bug 652183] Java SIG tracker bug
by Red Hat Bugzilla 22 Mar '16

22 Mar '16

https://bugzilla.redhat.com/show_bug.cgi?id=652183 Bug 652183 depends on bug 1316195, which changed state. Bug 1316195 Summary: Review Request: arquillian-core - Java Testing Platform for the JVM Member https://bugzilla.redhat.com/show_bug.cgi?id=1316195 What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution|--- |NOTABUG -- You are receiving this mail because: You are the QA Contact for the bug. You are the assignee for the bug.

1 0

[Bug 1282361] New: CVE-2015-5318 jenkins: Public value used for CSRF protection salt (SECURITY-169)
by Red Hat Bugzilla 22 Mar '16

22 Mar '16

https://bugzilla.redhat.com/show_bug.cgi?id=1282361 Bug ID: 1282361 Summary: CVE-2015-5318 jenkins: Public value used for CSRF protection salt (SECURITY-169) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: mprpic(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mizdebsk(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com The following flaw was found in Jenkins: The salt used to generate the CSRF protection tokens was a publicly accessible value, allowing malicious users to circumvent CSRF protection by generating the correct token. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=0p8soP2ceJ&a=cc_unsubscribe

1 6

[Bug 652183] Java SIG tracker bug
by Red Hat Bugzilla 22 Mar '16

22 Mar '16

https://bugzilla.redhat.com/show_bug.cgi?id=652183 Sopot Cela <scela(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On|1318363 | Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1318363 [Bug 1318363] Review Request: eclipse-epp-logging - Eclipse Error Reporting tool -- You are receiving this mail because: You are the QA Contact for the bug. You are the assignee for the bug.

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits March 2016