[Bug 1335417] New: CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

            Bug ID: 1335417
           Summary: CVE-2016-3723 jenkins: Information on installed
                    plugins exposed via API (SECURITY-250)
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team(a)redhat.com
          Reporter: anemec(a)redhat.com
                CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
                    ccoleman(a)redhat.com, dmcphers(a)redhat.com,
                    java-sig-commits(a)lists.fedoraproject.org,
                    jialiu(a)redhat.com, jkeck(a)redhat.com,
                    joelsmith(a)redhat.com, jokerman(a)redhat.com,
                    kseifried(a)redhat.com, lmeyer(a)redhat.com,
                    mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
                    msrb(a)redhat.com, tdawson(a)redhat.com,
                    tiwillia(a)redhat.com



The following flaw was found in Jenkins:

The XML/JSON API endpoints providing information about installed plugins were
missing permissions checks, allowing any user with read access to Jenkins to
determine which plugins and versions were installed.

External References:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

Andrej Nemec <anemec(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1335425



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

Andrej Nemec <anemec(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1335427



--- Comment #1 from Andrej Nemec <anemec(a)redhat.com&gt; ---

Created jenkins tracking bugs for this issue:

Affects: fedora-all [bug 1335427]


Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1335427
[Bug 1335427] CVE-2016-3721 CVE-2016-3722 CVE-2016-3723 CVE-2016-3724
CVE-2016-3725 CVE-2016-3726 CVE-2016-3727 jenkins: various flaws
[fedora-all]
-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417



--- Comment #2 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
jenkins-1.651.2-1.fc24 has been pushed to the Fedora 24 stable repository. If
problems still persist, please make note of it in this bug report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417
Bug 1335417 depends on bug 1335427, which changed state.

Bug 1335427 Summary: CVE-2016-3721 CVE-2016-3722 CVE-2016-3723 CVE-2016-3724 CVE-2016-3725
CVE-2016-3726 CVE-2016-3727 jenkins: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1335427

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417



--- Comment #3 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
jenkins-1.625.3-4.fc23 has been pushed to the Fedora 23 stable repository. If
problems still persist, please make note of it in this bug report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417



--- Comment #4 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
jenkins-1.609.3-7.fc22 has been pushed to the Fedora 22 stable repository. If
problems still persist, please make note of it in this bug report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417



--- Comment #5 from errata-xmlrpc <errata-xmlrpc(a)redhat.com&gt; ---
This issue has been addressed in the following products:

  Red Hat OpenShift Enterprise 3.2
  Red Hat OpenShift Enterprise 3.1

Via RHSA-2016:1206 https://access.redhat.com/errata/RHSA-2016:1206

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

Kurt Seifried <kseifried(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |ERRATA
        Last Closed|                            |2016-06-06 15:13:59



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417

Kurt Seifried <kseifried(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1349611



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1335417] CVE-2016-3723 jenkins: Information on installed plugins exposed via API (SECURITY-250)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335417



--- Comment #7 from errata-xmlrpc <errata-xmlrpc(a)redhat.com&gt; ---
This issue has been addressed in the following products:

  Red Hat OpenShift Enterprise 2.2

Via RHSA-2016:1773 https://rhn.redhat.com/errata/RHSA-2016-1773.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.