[Bug 1335420] New: CVE-2016-3725 jenkins: Regular users can trigger download of update site metadata (SECURITY-273)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1335420
Bug ID: 1335420
Summary: CVE-2016-3725 jenkins: Regular users can trigger
download of update site metadata (SECURITY-273)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com
The following flaw was found in Jenkins:
A missing permissions check allowed any user with access to Jenkins to trigger
an update of update site metadata. This could be combined with DNS cache
poisoning to disrupt Jenkins service.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 9 months
[Bug 1335418] New: CVE-2016-3724 jenkins: Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration (SECURITY-266)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1335418
Bug ID: 1335418
Summary: CVE-2016-3724 jenkins: Encrypted secrets (e.g.
passwords) were leaked to users with permission to
read configuration (SECURITY-266)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com
The following flaw was found in Jenkins:
Users with extended read access could access encrypted secrets stored directly
in the configuration of those items.
As a side-effect of this change, copying a job that contains secrets in its
configuration now requires the Configure permission on that job.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 9 months
[Bug 1335417] New: CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1335417
Bug ID: 1335417
Summary: CVE-2016-3723 jenkins: Information on installed
plugins exposed via API (SECURITY-250)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The XML/JSON API endpoints providing information about installed plugins were
missing permissions checks, allowing any user with read access to Jenkins to
determine which plugins and versions were installed.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 9 months
[Bug 1335416] New: CVE-2016-3722 jenkins: Malicious users with multiple user accounts can prevent other users from logging in (SECURITY-243)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1335416
Bug ID: 1335416
Summary: CVE-2016-3722 jenkins: Malicious users with multiple
user accounts can prevent other users from logging in
(SECURITY-243)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com
The following flaw was found in Jenkins:
By changing the freely editable 'full name', malicious users with multiple user
accounts could prevent other users from logging in, as 'full name' was resolved
before actual user name to determine which account is currently trying to log
in.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 9 months
[Bug 1335415] New: CVE-2016-3721 jenkins: Arbitrary build parameters are passed to build scripts as environment variables (SECURITY-170)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1335415
Bug ID: 1335415
Summary: CVE-2016-3721 jenkins: Arbitrary build parameters are
passed to build scripts as environment variables
(SECURITY-170)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com
The following flaw was found in Jenkins:
Build parameters in Jenkins typically are passed to build scripts as
environment variables. Some plugins allow passing arbitrary (undeclared)
parameters. Depending on access permissions and installed plugins, malicious
users were able to trigger builds, passing arbitrary environment variables
(e.g. PATH) to modify the behavior of those builds. Rather than expect all
plugin authors to be aware of this potential problem, Jenkins now filters the
build parameters based on what is defined on the job.
As this change is known to affect a number of plugins, it's possible to restore
the previous behavior by setting the system property
hudson.model.ParametersAction.keepUndefinedParameters to true. This is
potentially very unsafe and intended as a short-term workaround only.
To allow specific, known safe parameter names to be passed to builds, set the
system property hudson.model.ParametersAction.safeParameters to a
comma-separated list of safe parameter names. Example:
java -Dhudson.model.ParametersAction.safeParameters=FOO,BAR_BAZ,qux -jar
jenkins.war
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 9 months
[Bug 1311102] New: CVE-2016-0763 tomcat: security manager bypass via setGlobalContext() [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1311102
Bug ID: 1311102
Summary: CVE-2016-0763 tomcat: security manager bypass via
setGlobalContext() [fedora-all]
Product: Fedora
Version: 23
Component: tomcat
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: ivan.afonichev(a)gmail.com
Reporter: anemec(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
Blocks: 1311093 (CVE-2016-0763)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
[Bug 1311093] CVE-2016-0763 tomcat: security manager bypass via
setGlobalContext()
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 10 months