[Bug 1501817] New: jenkins: "Queue Item" remote API disclosed information about inaccessible jobs (SECURITY-618)

https://bugzilla.redhat.com/show_bug.cgi?id=1501817

Bug ID: 1501817
           Summary: jenkins: "Queue Item" remote API disclosed information
                    about inaccessible jobs (SECURITY-618)
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]

The remote API at /queue/item/(ID)/api showed information about tasks in the
queue (typically builds waiting to start). This included information about
tasks that the current user otherwise has no access to, e.g. due to lack of
Job/Read permission.

External References:

https://jenkins.io/security/advisory/2017-10-11/

[Bug 1501817] jenkins: "Queue Item" remote API disclosed information about inaccessible jobs (SECURITY-618)

https://bugzilla.redhat.com/show_bug.cgi?id=1501817

Adam Mariš  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1501826

[Bug 1501817] jenkins: "Queue Item" remote API disclosed information about inaccessible jobs (SECURITY-618)

https://bugzilla.redhat.com/show_bug.cgi?id=1501817

Kurt Seifried  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1501971

--- Comment #1 from Kurt Seifried  ---
Created jenkins tracking bugs for this issue:

Affects: openshift-1 [bug 1501971]

[Bug 1501817] CVE-2017-1000399 jenkins: "Queue Item" remote API disclosed information about inaccessible jobs (SECURITY-618)

https://bugzilla.redhat.com/show_bug.cgi?id=1501817

Adam Mariš  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|jenkins: "Queue Item"       |CVE-2017-1000399 jenkins:
                   |remote API disclosed        |"Queue Item" remote API
                   |information about           |disclosed information about
                   |inaccessible jobs           |inaccessible jobs
                   |(SECURITY-618)              |(SECURITY-618)
              Alias|                            |CVE-2017-1000399

[Bug 1501817] CVE-2017-1000399 jenkins: "Queue Item" remote API disclosed information about inaccessible jobs (SECURITY-618)

https://bugzilla.redhat.com/show_bug.cgi?id=1501817

Jason Shepherd  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail],
                   |                            |[e-mail],
                   |                            |[e-mail],
                   |                            |[e-mail]
         Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
                   |1011,reported=20171011,sour |1011,reported=20171011,sour
                   |ce=internet,cvss3=4.3/CVSS: |ce=internet,cvss3=4.3/CVSS:
                   |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U
                   |/C:L/I:N/A:N,cwe=CWE-200,op |/C:L/I:N/A:N,cwe=CWE-200,op
                   |enshift-enterprise-3/jenkin |enshift-enterprise-3/jenkin
                   |s=new,openshift-1/jenkins=a |s=affected,openshift-1/jenk
                   |ffected,fedora-all/jenkins= |ins=affected,fedora-all/jen
                   |affected                    |kins=affected

[Bug 1501817] CVE-2017-1000399 jenkins: "Queue Item" remote API disclosed information about inaccessible jobs (SECURITY-618)

https://bugzilla.redhat.com/show_bug.cgi?id=1501817

Jason Shepherd  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1558841, 1558840

--- Comment #2 from Jason Shepherd  ---
Created jenkins tracking bugs for this issue:

Affects: fedora-all [bug 1558840]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1558840
[Bug 1558840] CVE-2017-1000399 jenkins: "Queue Item" remote API disclosed
information about inaccessible jobs (SECURITY-618) [fedora-all]

[Bug 1501817] CVE-2017-1000399 jenkins: "Queue Item" remote API disclosed information about inaccessible jobs (SECURITY-618)

https://bugzilla.redhat.com/show_bug.cgi?id=1501817

Jason Shepherd  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
                   |1011,reported=20171011,sour |1011,reported=20171011,sour
                   |ce=internet,cvss3=4.3/CVSS: |ce=internet,cvss3=4.3/CVSS:
                   |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U
                   |/C:L/I:N/A:N,cwe=CWE-200,op |/C:L/I:N/A:N,cwe=CWE-200,op
                   |enshift-enterprise-3/jenkin |enshift-enterprise-3/jenkin
                   |s=affected,openshift-1/jenk |s=notaffected,openshift-1/j
                   |ins=affected,fedora-all/jen |enkins=affected,fedora-all/
                   |kins=affected               |jenkins=affected

--- Comment #4 from Jason Shepherd  ---
Openshift is now using Jenkins 2.89.2. Marking Enterprise and Online as not
affected.