[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAAWM14evUCZs2UoyXw2FU9ZSuM2NFFR+sNi7bA=o+-r7vfUcHw@mail.gmail.com>
Date: Wed, 17 Jul 2019 16:25:03 +0200
From: Wadeck Follonier <wfollonier@...udbees.com>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:
* Jenkins weekly 2.186
* Jenkins LTS 2.176.2
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2019-07-17/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-1424 / CVE-2019-10352
Users with Job/Configure permission could specify a relative path escaping
the base directory in the file name portion of a file parameter definition.
This path would be used to store the uploaded file on the Jenkins master,
resulting in an arbitrary file write vulnerability.
SECURITY-626 / CVE-2019-10353
By default, CSRF tokens in Jenkins only checked user authentication and IP
address.
This allowed attackers able to obtain a CSRF token for another user to
implement CSRF attacks as long as the victim's IP address remained unchanged.
SECURITY-534 / CVE-2019-10354
Jenkins uses the Stapler web framework to render its UI views.
These views are frequently comprised of several view fragments, enabling
plugins to extend existing views with more content.
In some cases attackers could directly access a view fragment containing
sensitive information, bypassing any permission checks in the corresponding
view.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
