[Bug 1730824] New: CVE-2019-10352 jenkins: Arbitrary file write vulnerability using file parameter definitions (SECURITY-1424)
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
Bug ID: 1730824 Summary: CVE-2019-10352 jenkins: Arbitrary file write vulnerability using file parameter definitions (SECURITY-1424) Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=moderate,public=20190717,reported=20190717,sour ce=internet,cvss3=6.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U /C:N/I:H/A:N,cwe=CWE-22,openshift-enterprise-3.6/jenki ns=new,openshift-enterprise-3.7/jenkins=new,openshift- enterprise-3.9/jenkins=new,openshift-enterprise-3.10/j enkins=new,openshift-enterprise-3.11/jenkins=new,opens hift-enterprise-4.1/jenkins=new,fedora-all/jenkins=aff ected Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: lpardo@redhat.com CC: abenaiss@redhat.com, adam.kaplan@redhat.com, ahardin@redhat.com, aos-bugs@redhat.com, bleanhar@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, eparis@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jokerman@redhat.com, mchappel@redhat.com, mizdebsk@redhat.com, msrb@redhat.com, vbobade@redhat.com, wzheng@redhat.com Target Milestone: --- Classification: Other
A vulnerability was found in Jenkins versions weekly before 2.186 and LTS before 2.176.2. Users with Job/Configure permission could specify a relative path escaping the base directory in the file name portion of a file parameter definition. This path would be used to store the uploaded file on the Jenkins master, resulting in an arbitrary file write vulnerability. This vulnerability is the result of an incomplete fix for SECURITY-1074. File parameters that escape the base directory are no longer accepted and the build will fail.
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
--- Comment #1 from Laura Pardo lpardo@redhat.com --- External References:
https://jenkins.io/security/advisory/2019-07-17/
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
Laura Pardo lpardo@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1730827
--- Comment #2 from Laura Pardo lpardo@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1730827]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1730827 [Bug 1730827] CVE-2019-10352 jenkins: Arbitrary file write vulnerability using file parameter definitions (SECURITY-1424) [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
Laura Pardo lpardo@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1730879
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2019 |impact=moderate,public=2019 |0717,reported=20190717,sour |0717,reported=20190717,sour |ce=internet,cvss3=6.5/CVSS: |ce=internet,cvss3=6.5/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U |/C:N/I:H/A:N,cwe=CWE-22,ope |/C:N/I:H/A:N,cwe=CWE-22,ope |nshift-enterprise-3.6/jenki |nshift-enterprise-3.6/jenki |ns=new,openshift-enterprise |ns=new,openshift-enterprise |-3.7/jenkins=new,openshift- |-3.7/jenkins=new,openshift- |enterprise-3.9/jenkins=new, |enterprise-3.9/jenkins=new, |openshift-enterprise-3.10/j |openshift-enterprise-3.10/j |enkins=new,openshift-enterp |enkins=new,openshift-enterp |rise-3.11/jenkins=new,opens |rise-3.11/jenkins=new,opens |hift-enterprise-4.1/jenkins |hift-enterprise-4.1/jenkins |=new,fedora-all/jenkins=aff |=affected,fedora-all/jenkin |ected |s=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1731021
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2019 |impact=moderate,public=2019 |0717,reported=20190717,sour |0717,reported=20190717,sour |ce=internet,cvss3=6.5/CVSS: |ce=internet,cvss3=6.5/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U |/C:N/I:H/A:N,cwe=CWE-22,ope |/C:N/I:H/A:N,cwe=CWE-22,ope |nshift-enterprise-3.6/jenki |nshift-enterprise-3.6/jenki |ns=new,openshift-enterprise |ns=new,openshift-enterprise |-3.7/jenkins=new,openshift- |-3.7/jenkins=new,openshift- |enterprise-3.9/jenkins=new, |enterprise-3.9/jenkins=new, |openshift-enterprise-3.10/j |openshift-enterprise-3.10/j |enkins=new,openshift-enterp |enkins=new,openshift-enterp |rise-3.11/jenkins=new,opens |rise-3.11/jenkins=affected, |hift-enterprise-4.1/jenkins |openshift-enterprise-4.1/je |=affected,fedora-all/jenkin |nkins=affected,fedora-all/j |s=affected |enkins=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1731024
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2019 |impact=moderate,public=2019 |0717,reported=20190717,sour |0717,reported=20190717,sour |ce=internet,cvss3=6.5/CVSS: |ce=internet,cvss3=6.5/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U |/C:N/I:H/A:N,cwe=CWE-22,ope |/C:N/I:H/A:N,cwe=CWE-22,ope |nshift-enterprise-3.6/jenki |nshift-enterprise-3.6/jenki |ns=new,openshift-enterprise |ns=wontfix,openshift-enterp |-3.7/jenkins=new,openshift- |rise-3.7/jenkins=wontfix,op |enterprise-3.9/jenkins=new, |enshift-enterprise-3.9/jenk |openshift-enterprise-3.10/j |ins=wontfix,openshift-enter |enkins=new,openshift-enterp |prise-3.10/jenkins=wontfix, |rise-3.11/jenkins=affected, |openshift-enterprise-3.11/j |openshift-enterprise-4.1/je |enkins=affected,openshift-e |nkins=affected,fedora-all/j |nterprise-4.1/jenkins=affec |enkins=affected |ted,fedora-all/jenkins=affe | |cted
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
--- Comment #5 from Sam Fowler sfowler@redhat.com --- "Any security advisory related updates to Jenkins core or the plugins we include in the OpenShift Jenkins master image will only occur in the v3.11 and v4.x branches of this repository."
https://github.com/openshift/jenkins/blob/master/README.md#jenkins-security-...
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
Akram Ben Aissi abenaiss@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1731034
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2019 |impact=moderate,public=2019 |0717,reported=20190717,sour |0717,reported=20190717,sour |ce=internet,cvss3=6.5/CVSS: |ce=internet,cvss3=6.5/CVSS: |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U |/C:N/I:H/A:N,cwe=CWE-22,ope |/C:N/I:H/A:N,cwe=CWE-22,ope |nshift-enterprise-3.6/jenki |nshift-enterprise-3.6/jenki |ns=wontfix,openshift-enterp |ns=wontfix,openshift-enterp |rise-3.7/jenkins=wontfix,op |rise-3.7/jenkins=wontfix,op |enshift-enterprise-3.9/jenk |enshift-enterprise-3.9/jenk |ins=wontfix,openshift-enter |ins=wontfix,openshift-enter |prise-3.10/jenkins=wontfix, |prise-3.10/jenkins=wontfix, |openshift-enterprise-3.11/j |openshift-enterprise-3.11/j |enkins=affected,openshift-e |enkins=affected,openshift-e |nterprise-4.1/jenkins=affec |nterprise-4.1/jenkins=affec |ted,fedora-all/jenkins=affe |ted,fedora-all/jenkins=affe |cted |cted,openshift-4.2/jenkins= | |affected
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
--- Comment #6 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 3.11
Via RHSA-2019:2503 https://access.redhat.com/errata/RHSA-2019:2503
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2503
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2019-08-15 14:47:03
--- Comment #7 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2019-10352
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
--- Comment #8 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.1
Via RHSA-2019:2548 https://access.redhat.com/errata/RHSA-2019:2548
https://bugzilla.redhat.com/show_bug.cgi?id=1730824
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2548
https://bugzilla.redhat.com/show_bug.cgi?id=1730824 Bug 1730824 depends on bug 1730827, which changed state.
Bug 1730827 Summary: CVE-2019-10352 jenkins: Arbitrary file write vulnerability using file parameter definitions (SECURITY-1424) [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1730827
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
java-sig-commits@lists.fedoraproject.org
-
bugzilla＠redhat.com