[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <505BCE6C.1010805@redhat.com>
Date: Thu, 20 Sep 2012 20:18:20 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
info@...udbees.com, security@...udbees.com
Subject: CVE Request: Jenkins and plugins
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-09-17.cb
Jenkins Security Advisory 2012-09-17
This advisory announces security vulnerabilities that were found in
Jenkins core and several plugins.
The first vulnerability in Jenkins core allows unprivileged users to
insert data into Jenkins master, which can lead to remote code
execution. For this vulnerability to be exploited, the attacker must
have an HTTP access to a Jenkins master, and he must have a read
access to Jenkins.
The second vulnerability in Jenkins core is a cross-site scripting
vulnerability. This allows an attacker to craft a URL that points to
Jenkins, and if a legitimate user clicks this link, the attacker will
be able to hijack the user session.
The third vulnerability is a cross-site scripting vulnerability in the
Violations plugin.
The fourth vulnerability is a cross-site scripting vulnerability in
the CI game plugin.
Several of these vulnerabilies were discovered by Avram Marius Gabriel.
Severity:
CloudBees rates the first vulnerability in the core as critical, as it
allows malicious users to execute arbitrary code on the server. The
othe three XSS vulnerabilities are rated as high, as they allow
malicious users to escalate privileges.
Fix:
The following versions incorporate fixes to the vulnerabilities found
in the Jenkins core.
Main line users should upgrade to Jenkins 1.482
LTS users should upgrade to 1.466.2
Users of Jenkins Enterprise by CloudBees 1.466.x should upgrade to
1.466.2.1
Users of Jenkins Enterprise by CloudBees 1.447.x should upgrade to
1.447.3.1
Users of Jenkins Enterprise by CloudBees 1.424.x and earlier
should upgrade to 1.424.6.11
The fix has already been deployed to DEV@...ud
Users of the CloudBees Custom Update Center plugin needs to update to
3.4 or later in order to work with these newer versions of Jenkins.
To patch vulnerabilities in the plugins, upgrade to the following
versions. These plugins should be available in your Jenkins' plugin
update center UI in up to a day.
Users of the Violations plugin should upgrade to 0.7.11 or later
Users of the CI game plugin should upgrade to 1.19 or later
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iQIcBAEBAgAGBQJQW85sAAoJEBYNRVNeJnmTXvMP+gJwt6fdMYKE3PZ2w/Vx6GsV
pAcQ9T+5uLUgt9ITcmcYJM+0N8AUq57RWgxtnyoElbI/ZbWQwqYIfkvhLqJA5tSl
kaj7b8CjcH9bmH/ODCISF80Frmc+BUWfk8aS3gFhXkQUzat5zz1rue7ugl+Ef0Xk
QOzND2vkfOzUrIIclY2l5nPqP0HoIdN19jI5uUV0ZKTK0kTgx55O0tOyOore/X8C
g8H5jnDQjQOXCdRKc9mSwz8A8E2xjvvc2Hbdkys1E01x9GONRW373165Ukzc76Vd
dapPMw0mEBpFEewYWS6yuNMttSOHaKXHtRe/tWFat/q61yeLyIxwDzUIJ3yHLq0n
trRXjPpVAoV7OnlMIGLeZEUI3lIXN+JP7kj4iJFymmDDUQwpwUzTmPURmHIYIPYX
ILnD1qTTbmscV0CZ0nBX0Tc8/tzp2/0An8DjRVt3ePJTjrY6rWUqYH46nm6DdZ00
ZJiAhS0rDl+pZiZCseqT2hz7ZTVvAEwVe0rLeB7p8jypLRGRuUG08Dr090vkFpB/
DQUMmWlXo/9cHJpTivtT3r5uQg5/Og5s3/z0ke01bM7fen08vFilmC70VJ3jLgdk
5MulIFS1m69YvRxea9DcwN8PFAFj62wEA3r8fszA40k2P54OQhq7Xt1wIY8fxy9t
YoNuQNh6zcm2ckIwWgYG
=DlGG
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
