[Bug 1501818] New: jenkins: "Job" remote API disclosed information about inaccessible upstream/ downstream jobs (SECURITY-617)
https://bugzilla.redhat.com/show_bug.cgi?id=1501818
Bug ID: 1501818 Summary: jenkins: "Job" remote API disclosed information about inaccessible upstream/downstream jobs (SECURITY-617) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: bleanhar@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jkeck@redhat.com, kseifried@redhat.com, mizdebsk@redhat.com, msrb@redhat.com
The remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Job/Read permission.
External References:
https://jenkins.io/security/advisory/2017-10-11/
https://bugzilla.redhat.com/show_bug.cgi?id=1501818
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1501826
https://bugzilla.redhat.com/show_bug.cgi?id=1501818
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|jenkins: "Job" remote API |CVE-2017-1000400 jenkins: |disclosed information about |"Job" remote API disclosed |inaccessible |information about |upstream/downstream jobs |inaccessible |(SECURITY-617) |upstream/downstream jobs | |(SECURITY-617) Alias| |CVE-2017-1000400
https://bugzilla.redhat.com/show_bug.cgi?id=1501818
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ahardin@redhat.com, | |dbaker@redhat.com, | |jokerman@redhat.com, | |mchappel@redhat.com Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |1011,reported=20171011,sour |1011,reported=20171011,sour |ce=internet,cvss3=4.3/CVSS: |ce=internet,cvss3=4.3/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U |/C:L/I:N/A:N,cwe=CWE-200,op |/C:L/I:N/A:N,cwe=CWE-200,op |enshift-enterprise-3/jenkin |enshift-enterprise-3/jenkin |s=new,openshift-1/jenkins=a |s=affected,openshift-1/jenk |ffected,fedora-all/jenkins= |ins=affected,fedora-all/jen |affected |kins=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1501818
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1558871, 1558873, 1558872
--- Comment #1 from Jason Shepherd jshepherd@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1558871]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1558871 [Bug 1558871] CVE-2017-1000400 jenkins: "Job" remote API disclosed information about inaccessible upstream/downstream jobs (SECURITY-617) [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1501818
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |1011,reported=20171011,sour |1011,reported=20171011,sour |ce=internet,cvss3=4.3/CVSS: |ce=internet,cvss3=4.3/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U |/C:L/I:N/A:N,cwe=CWE-200,op |/C:L/I:N/A:N,cwe=CWE-200,op |enshift-enterprise-3/jenkin |enshift-enterprise-3/jenkin |s=affected,openshift-1/jenk |s=notaffected,openshift-1/j |ins=affected,fedora-all/jen |enkins=affected,fedora-all/ |kins=affected |jenkins=affected
--- Comment #3 from Jason Shepherd jshepherd@redhat.com --- Openshift Enterprise now uses Jenkins 2.89.2. Marking as not affected.
java-sig-commits@lists.fedoraproject.org
-
bugzilla＠redhat.com