[Bug 1205615] New: CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
5:36 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
Bug ID: 1205615
Summary: CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS
vulnerability (SECURITY-171, SECURITY-177)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: vkaigoro(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com
An attacker without any access to Jenkins can navigate the user to a carefully
crafted URL and have the user execute unintended actions. This vulnerability
can be used to attack Jenkins inside firewalls from outside so long as the
location of Jenkins is known to the attacker.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=aUngdTWJZ8&a=cc_unsubscribe
5:42 a.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
Vasyl Kaigorodov <vkaigoro(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version| |Jenkins 1.606, Jenkins
| |1.596.2
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=u4klwn3hWM&a=cc_unsubscribe
6:03 a.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
Vasyl Kaigorodov <vkaigoro(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1205634
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=dI9dbHUdrP&a=cc_unsubscribe
6:04 a.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
Vasyl Kaigorodov <vkaigoro(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1205637
Depends On| |1205638
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1205637
[Bug 1205637] CVE-2015-1813 CVE-2015-1812 jenkins: Reflective XSS
vulnerability (SECURITY-171, SECURITY-177) [fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=I3ZaGGRG8s&a=cc_unsubscribe
6:05 a.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
--- Comment #2 from Vasyl Kaigorodov <vkaigoro(a)redhat.com> ---
Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1205637]
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=L9iSiMb9mA&a=cc_unsubscribe
4:43 a.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
Bug 1205615 depends on bug 1205637, which changed state.
Bug 1205637 Summary: CVE-2015-1806 CVE-2015-1807 CVE-2015-1813 CVE-2015-1812 CVE-2015-1811
CVE-2015-1810 CVE-2015-1808 CVE-2015-1809 CVE-2015-1814 jenkins: various flaws
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1205637
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Resolution|--- |ERRATA
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=7N4ICtGRIM&a=cc_unsubscribe
4:43 a.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
--- Comment #3 from Fedora Update System <updates(a)fedoraproject.org> ---
jenkins-1.590-3.fc21 has been pushed to the Fedora 21 stable repository. If
problems still persist, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=PWsHH01mv9&a=cc_unsubscribe
2:08 p.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
--- Comment #4 from Fedora Update System <updates(a)fedoraproject.org> ---
jenkins-1.606-1.fc22, jffi-1.2.7-5.fc22, jenkins-executable-war-1.29-4.fc22 has
been pushed to the Fedora 22 stable repository. If problems still persist,
please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=L3iWP8dPJA&a=cc_unsubscribe
2:56 p.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1248781
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=C4YD6axOux&a=cc_unsubscribe
9:07 p.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
--- Doc Text *updated* by Kurt Seifried <kseifried(a)redhat.com> ---
Two cross-site scripting (XSS) flaws were found in Jenkins. A remote attacker could use
these flaws to conduct XSS attacks against users of an application using Jenkins.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=GgeqsOMprK&a=cc_unsubscribe
6:27 p.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015
|0323,reported=20150325,sour |0323,reported=20150325,sour
|ce=internet,cvss2=4.3/AV:N/ |ce=internet,cvss2=4.3/AV:N/
|AC:M/Au:N/C:N/I:P/A:N,fedor |AC:M/Au:N/C:N/I:P/A:N,cwe=C
|a-all/jenkins=affected,open |WE-79,fedora-all/jenkins=af
|shift-enterprise-2/jenkins= |fected,openshift-enterprise
|affected,openshift-1/jenkin |-2/jenkins=affected,openshi
|s=affected |ft-1/jenkins=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=0CBG3aAnAI&a=cc_unsubscribe
_______________________________________________
java-sig-commits mailing list
java-sig-commits(a)lists.fedoraproject.org
http://lists.fedoraproject.org/postorius/java-sig-commits@lists.fedorapro...
11:36 a.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
--- Comment #7 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
RHEL 6 Version of OpenShift Enterprise 2.2
Via RHSA-2015:1844 https://rhn.redhat.com/errata/RHSA-2015-1844.html
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=lPSJzBWDTO&a=cc_unsubscribe
11:42 a.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |ERRATA
Last Closed| |2015-09-30 12:42:47
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=9zSlRv9fUx&a=cc_unsubscribe
6:52 p.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS
vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|CLOSED |NEW
Resolution|ERRATA |---
Keywords| |Reopened
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=y6x1y8syFU&a=cc_unsubscribe
1:15 p.m.
New subject: [Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
--- Comment #9 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
RHEL 7 Version of OpenShift Enterprise 3.1
Via RHSA-2016:0070 https://access.redhat.com/errata/RHSA-2016:0070
--
You are receiving this mail because:
You are on the CC list for the bug.
3051
days inactive
3358
days old
java-sig-commits@lists.fedoraproject.org
14 comments
1 participants
participants (1)
-
Red Hat Bugzilla