[Bug 1326403] New: CVE-2016-3102 jenkins: Groovy sandbox protection incomplete in Script Security Plugin (SECURITY-258)
10:18 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1326403
Bug ID: 1326403
Summary: CVE-2016-3102 jenkins: Groovy sandbox protection
incomplete in Script Security Plugin (SECURITY-258)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The Script Security plugin provides a Groovy sandbox implementation to other
plugins that only allows whitelisted commands to be executed. This sandbox did
not cover direct field access (foo.@bar) or get/set array operations
(foo[bar]).
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
10:19 a.m.
New subject: [Bug 1326403] CVE-2016-3102 jenkins: Groovy sandbox protection incomplete in Script Security Plugin (SECURITY-258)
https://bugzilla.redhat.com/show_bug.cgi?id=1326403
Adam Mariš <amaris(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1326405
--
You are receiving this mail because:
You are on the CC list for the bug.
10:21 a.m.
New subject: [Bug 1326403] CVE-2016-3102 jenkins: Groovy sandbox protection incomplete in Script Security Plugin (SECURITY-258)
https://bugzilla.redhat.com/show_bug.cgi?id=1326403
Adam Mariš <amaris(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1326407
Depends On| |1326408
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1326408
[Bug 1326408] CVE-2016-3101 CVE-2016-3102 jenkins: various flaws
[fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
10:21 a.m.
New subject: [Bug 1326403] CVE-2016-3102 jenkins: Groovy sandbox protection incomplete in Script Security Plugin (SECURITY-258)
https://bugzilla.redhat.com/show_bug.cgi?id=1326403
--- Comment #2 from Adam Mariš <amaris(a)redhat.com> ---
Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1326408]
--
You are receiving this mail because:
You are on the CC list for the bug.
1:46 p.m.
New subject: [Bug 1326403] CVE-2016-3102 jenkins: Groovy sandbox protection incomplete in Script Security Plugin (SECURITY-258)
https://bugzilla.redhat.com/show_bug.cgi?id=1326403
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |NOTABUG
Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016
|0411,reported=20160411,sour |0411,reported=20160411,sour
|ce=internet,cvss2=6.4/AV:N/ |ce=internet,cvss2=6.4/AV:N/
|AC:L/Au:N/C:P/I:P/A:N,opens |AC:L/Au:N/C:P/I:P/A:N,opens
|hift-enterprise-3/jenkins=n |hift-enterprise-3/jenkins=n
|ew,openshift-enterprise-2/j |otaffected,openshift-enterp
|enkins=new,openshift-1/jenk |rise-2/jenkins=notaffected,
|ins=affected,fedora-all/jen |openshift-1/jenkins=notaffe
|kins=affected |cted,fedora-all/jenkins=aff
| |ected
Last Closed| |2016-05-04 14:46:11
--- Comment #3 from Kurt Seifried <kseifried(a)redhat.com> ---
These are in Jenkins plugins that do not ship with OpenShift Enterprise.
--
You are receiving this mail because:
You are on the CC list for the bug.
10:13 a.m.
New subject: [Bug 1326403] CVE-2016-3102 jenkins: Groovy sandbox protection incomplete in Script Security Plugin ( SECURITY-258)
https://bugzilla.redhat.com/show_bug.cgi?id=1326403
--- Comment #4 from Fedora Update System <updates(a)fedoraproject.org> ---
jenkins-1.651.1-1.fc24, jenkins-credentials-plugin-1.27-1.fc24,
jenkins-junit-plugin-1.12-1.fc24, jenkins-mailer-plugin-1.17-1.fc24,
jenkins-remoting-2.57-1.fc24, jenkins-script-security-plugin-1.18.1-1.fc24,
owasp-java-html-sanitizer-20160422.1-1.fc24, stapler-1.242-1.fc24,
tiger-types-2.2-1.fc24 has been pushed to the Fedora 24 stable repository. If
problems still persist, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
10:14 a.m.
New subject: [Bug 1326403] CVE-2016-3102 jenkins: Groovy sandbox protection incomplete in Script Security Plugin ( SECURITY-258)
https://bugzilla.redhat.com/show_bug.cgi?id=1326403
Bug 1326403 depends on bug 1326408, which changed state.
Bug 1326408 Summary: CVE-2016-3101 CVE-2016-3102 jenkins: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1326408
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Resolution|--- |ERRATA
--
You are receiving this mail because:
You are on the CC list for the bug.
2938
days inactive
2973
days old
java-sig-commits@lists.fedoraproject.org
6 comments
1 participants
participants (1)
-
Red Hat Bugzilla