[Bug 1501813] New: jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490)
4:20 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Bug ID: 1501813
Summary: jenkins: Jenkins core bundled vulnerable version of
the commons-fileupload library (SECURITY-490)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Jenkins bundled a version of the commons-fileupload library with the
denial-of-service vulnerability known as CVE-2016-3092.
External References:
https://jenkins.io/security/advisory/2017-10-11/
--
You are receiving this mail because:
You are on the CC list for the bug.
4:28 a.m.
New subject: [Bug 1501813] jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490)
https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Adam Mariš <amaris(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1501826
--
You are receiving this mail because:
You are on the CC list for the bug.
10:34 a.m.
New subject: [Bug 1501813] jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490)
https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1501968
--- Comment #1 from Kurt Seifried <kseifried(a)redhat.com> ---
Created jenkins tracking bugs for this issue:
Affects: openshift-1 [bug 1501968]
--
You are receiving this mail because:
You are on the CC list for the bug.
11:49 p.m.
New subject: [Bug 1501813] jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490)
https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Mark Knowles <mknowles(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|71011,reported=20171011,sou |71011,reported=20171011,sou
|rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS
|:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S:
|U/C:N/I:N/A:H,cwe=CWE-400,o |U/C:N/I:N/A:H,cwe=CWE-400,o
|penshift-enterprise-3/jenki |penshift-enterprise-3/jenki
|ns=new,openshift-1/jenkins= |ns=affected,openshift-1/jen
|affected,fedora-all/jenkins |kins=affected,fedora-all/je
|=affected |nkins=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
11:49 p.m.
New subject: [Bug 1501813] jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490)
https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Mark Knowles <mknowles(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1515069, 1515068
--- Comment #2 from Mark Knowles <mknowles(a)redhat.com> ---
Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1515068]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1515068
[Bug 1515068] jenkins: Jenkins core bundled vulnerable version of the
commons-fileupload library (SECURITY-490) [fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
4:57 a.m.
New subject: [Bug 1501813] CVE-2017-1000394 jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490)
https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Adam Mariš <amaris(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|jenkins: Jenkins core |CVE-2017-1000394 jenkins:
|bundled vulnerable version |Jenkins core bundled
|of the commons-fileupload |vulnerable version of the
|library (SECURITY-490) |commons-fileupload library
| |(SECURITY-490)
Alias| |CVE-2017-1000394
--
You are receiving this mail because:
You are on the CC list for the bug.
11:09 p.m.
New subject: [Bug 1501813] CVE-2017-1000394 jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490)
https://bugzilla.redhat.com/show_bug.cgi?id=1501813
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |ahardin(a)redhat.com,
| |dbaker(a)redhat.com,
| |jokerman(a)redhat.com,
| |mchappel(a)redhat.com
Whiteboard|impact=important,public=201 |impact=important,public=201
|71011,reported=20171011,sou |71011,reported=20171011,sou
|rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS
|:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S:
|U/C:N/I:N/A:H,cwe=CWE-400,o |U/C:N/I:N/A:H,cwe=CWE-400,o
|penshift-enterprise-3/jenki |penshift-enterprise-3/jenki
|ns=affected,openshift-1/jen |ns=notaffected,openshift-1/
|kins=affected,fedora-all/je |jenkins=affected,fedora-all
|nkins=affected |/jenkins=affected
--- Comment #4 from Jason Shepherd <jshepherd(a)redhat.com> ---
openshift3/jenkins-2-rhel7 now uses version 2.89.2
Marking Openshift Enteprise 3 as not affected.
--
You are receiving this mail because:
You are on the CC list for the bug.
2223
days inactive
2395
days old
java-sig-commits@lists.fedoraproject.org
6 comments
1 participants
participants (1)
-
bugzilla＠redhat.com