8:33 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1656865
Bug ID: 1656865
Summary: jenkins: code execution through crafted URLs
(SECURITY-595)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: urgent
Priority: urgent
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
eparis(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com, wzheng(a)redhat.com
A flaw was found in the way Jenkins uses the Stapler web framework for HTTP
request handling. Stapler’s basic premise is that it uses reflective access to
code elements matching its naming conventions. As these naming conventions
closely match common code patterns in Java, accessing crafted URLs could invoke
methods never intended to be invoked this way.
References:
https://jenkins.io/security/advisory/2018-12-05/
--
You are receiving this mail because:
You are on the CC list for the bug.
8:33 a.m.
New subject: [Bug 1656865] jenkins: code execution through crafted URLs (SECURITY-595)
https://bugzilla.redhat.com/show_bug.cgi?id=1656865
Laura Pardo <lpardo(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1656866
--- Comment #1 from Laura Pardo <lpardo(a)redhat.com> ---
Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1656866]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1656866
[Bug 1656866] jenkins: code execution through crafted URLs (SECURITY-595)
[fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
8:34 a.m.
New subject: [Bug 1656865] jenkins: code execution through crafted URLs (SECURITY-595)
https://bugzilla.redhat.com/show_bug.cgi?id=1656865
Laura Pardo <lpardo(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1656867
--
You are receiving this mail because:
You are on the CC list for the bug.
10:36 p.m.
New subject: [Bug 1656865] jenkins: code execution through crafted URLs (SECURITY-595)
https://bugzilla.redhat.com/show_bug.cgi?id=1656865
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=critical,public=2018 |impact=critical,public=2018
|1205,reported=20181205,sour |1205,reported=20181205,sour
|ce=internet,cvss3=9.8/CVSS: |ce=internet,cvss3=9.8/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U
|/C:H/I:H/A:H,cwe=CWE-470,fe |/C:H/I:H/A:H,cwe=CWE-470,fe
|dora-all/jenkins=affected,o |dora-all/jenkins=affected,o
|penshift-enterprise-3.1/jen |penshift-enterprise-3.1/jen
|kins=new,openshift-enterpri |kins=affected,openshift-ent
|se-3.4/jenkins=new,openshif |erprise-3.4/jenkins=affecte
|t-enterprise-3.2/jenkins=ne |d,openshift-enterprise-3.2/
|w,openshift-enterprise-3.3/ |jenkins=affected,openshift-
|jenkins=new,openshift-enter |enterprise-3.3/jenkins=affe
|prise-3.5/jenkins=new,opens |cted,openshift-enterprise-3
|hift-enterprise-3.6/jenkins |.5/jenkins=affected,openshi
|=new,openshift-enterprise-3 |ft-enterprise-3.6/jenkins=a
|.7/jenkins=new,openshift-en |ffected,openshift-enterpris
|terprise-3.10/jenkins=new,o |e-3.7/jenkins=affected,open
|penshift-enterprise-3.9/jen |shift-enterprise-3.10/jenki
|kins=new,openshift-enterpri |ns=affected,openshift-enter
|se-3.11/jenkins=new |prise-3.9/jenkins=affected,
| |openshift-enterprise-3.11/j
| |enkins=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
10:36 p.m.
New subject: [Bug 1656865] jenkins: code execution through crafted URLs (SECURITY-595)
https://bugzilla.redhat.com/show_bug.cgi?id=1656865
--- Comment #2 from Jason Shepherd <jshepherd(a)redhat.com> ---
Statement:
From upstream advisory:
As of publication of this advisory, we are aware of the following potential
attacks in the latest Jenkins releases that do not yet contain this fix:
Unauthenticated users can invalidate all sessions
Users with Overall/Read permission could create new user objects in memory.
Users with Overall/Read access could manually kick off otherwise periodically
executed runs of implementations of AsyncPeriodicWork.
Given the vast potential attack surface, we fully expect other attacks, that we
are not currently aware of, to be possible on Jenkins releases that do not have
this fix applied. This is reflected in the high score we assigned to this
issue, rather than limiting the score to the impact through known issues.
--
You are receiving this mail because:
You are on the CC list for the bug.
10:41 p.m.
New subject: [Bug 1656865] jenkins: code execution through crafted URLs (SECURITY-595)
https://bugzilla.redhat.com/show_bug.cgi?id=1656865
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1657090, 1657085, 1657092,
| |1657089, 1657088, 1657091,
| |1657093, 1657084, 1657087,
| |1657086
--
You are receiving this mail because:
You are on the CC list for the bug.
10:44 p.m.
New subject: [Bug 1656865] jenkins: code execution through crafted URLs (SECURITY-595)
https://bugzilla.redhat.com/show_bug.cgi?id=1656865
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |abhgupta(a)redhat.com,
| |dbaker(a)redhat.com,
| |sthangav(a)redhat.com,
| |trankin(a)redhat.com
Whiteboard|impact=critical,public=2018 |impact=critical,public=2018
|1205,reported=20181205,sour |1205,reported=20181205,sour
|ce=internet,cvss3=9.8/CVSS: |ce=internet,cvss3=9.8/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U
|/C:H/I:H/A:H,cwe=CWE-470,fe |/C:H/I:H/A:H,cwe=CWE-470,fe
|dora-all/jenkins=affected,o |dora-all/jenkins=affected,o
|penshift-enterprise-3.1/jen |penshift-enterprise-3.1/jen
|kins=affected,openshift-ent |kins=affected,openshift-ent
|erprise-3.4/jenkins=affecte |erprise-3.4/jenkins=affecte
|d,openshift-enterprise-3.2/ |d,openshift-enterprise-3.2/
|jenkins=affected,openshift- |jenkins=affected,openshift-
|enterprise-3.3/jenkins=affe |enterprise-3.3/jenkins=affe
|cted,openshift-enterprise-3 |cted,openshift-enterprise-3
|.5/jenkins=affected,openshi |.5/jenkins=affected,openshi
|ft-enterprise-3.6/jenkins=a |ft-enterprise-3.6/jenkins=a
|ffected,openshift-enterpris |ffected,openshift-enterpris
|e-3.7/jenkins=affected,open |e-3.7/jenkins=affected,open
|shift-enterprise-3.10/jenki |shift-enterprise-3.10/jenki
|ns=affected,openshift-enter |ns=affected,openshift-enter
|prise-3.9/jenkins=affected, |prise-3.9/jenkins=affected,
|openshift-enterprise-3.11/j |openshift-enterprise-3.11/j
|enkins=affected |enkins=affected,openshift-o
| |nline-3/jenkins=defer
--
You are receiving this mail because:
You are on the CC list for the bug.
12:53 a.m.
New subject: [Bug 1656865] jenkins: code execution through crafted URLs (SECURITY-595)
https://bugzilla.redhat.com/show_bug.cgi?id=1656865
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|urgent |high
Whiteboard|impact=critical,public=2018 |impact=important,public=201
|1205,reported=20181205,sour |81205,reported=20181205,sou
|ce=internet,cvss3=9.8/CVSS: |rce=internet,cvss3=8.8/CVSS
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |:3.0/AV:N/AC:L/PR:L/UI:N/S:
|/C:H/I:H/A:H,cwe=CWE-470,fe |U/C:H/I:H/A:H,cwe=CWE-470,f
|dora-all/jenkins=affected,o |edora-all/jenkins=affected,
|penshift-enterprise-3.1/jen |openshift-enterprise-3.1/je
|kins=affected,openshift-ent |nkins=affected,openshift-en
|erprise-3.4/jenkins=affecte |terprise-3.4/jenkins=affect
|d,openshift-enterprise-3.2/ |ed,openshift-enterprise-3.2
|jenkins=affected,openshift- |/jenkins=affected,openshift
|enterprise-3.3/jenkins=affe |-enterprise-3.3/jenkins=aff
|cted,openshift-enterprise-3 |ected,openshift-enterprise-
|.5/jenkins=affected,openshi |3.5/jenkins=affected,opensh
|ft-enterprise-3.6/jenkins=a |ift-enterprise-3.6/jenkins=
|ffected,openshift-enterpris |affected,openshift-enterpri
|e-3.7/jenkins=affected,open |se-3.7/jenkins=affected,ope
|shift-enterprise-3.10/jenki |nshift-enterprise-3.10/jenk
|ns=affected,openshift-enter |ins=affected,openshift-ente
|prise-3.9/jenkins=affected, |rprise-3.9/jenkins=affected
|openshift-enterprise-3.11/j |,openshift-enterprise-3.11/
|enkins=affected,openshift-o |jenkins=affected,openshift-
|nline-3/jenkins=defer |online-3/jenkins=defer
Severity|urgent |high
--- Comment #4 from Jason Shepherd <jshepherd(a)redhat.com> ---
From upstream advisory:
As of publication of this advisory, we are aware of the following potential
attacks in the latest Jenkins releases that do not yet contain this fix:
Unauthenticated users can invalidate all sessions
Users with Overall/Read permission could create new user objects in memory.
Users with Overall/Read access could manually kick off otherwise periodically
executed runs of implementations of AsyncPeriodicWork.
Given the vast potential attack surface, we fully expect other attacks, that we
are not currently aware of, to be possible on Jenkins releases that do not have
this fix applied. This is reflected in the high score we assigned to this
issue, rather than limiting the score to the impact through known issues.
--
You are receiving this mail because:
You are on the CC list for the bug.
12:53 a.m.
New subject: [Bug 1656865] jenkins: code execution through crafted URLs (SECURITY-595)
https://bugzilla.redhat.com/show_bug.cgi?id=1656865
--- Comment #5 from Jason Shepherd <jshepherd(a)redhat.com> ---
Statement:
This vulnerability is only exploitable by a user with developer permissions.
Therefore this vulnerability is rated Important for OpenShift Container
Platform 3.x.
--
You are receiving this mail because:
You are on the CC list for the bug.
9:12 a.m.
New subject: [Bug 1656865] jenkins: code execution through crafted URLs (SECURITY-595)
https://bugzilla.redhat.com/show_bug.cgi?id=1656865
Gabe Montero <gmontero(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |gmontero(a)redhat.com
--- Comment #6 from Gabe Montero <gmontero(a)redhat.com> ---
PR https://github.com/openshift/jenkins/pull/749 created for 3.11
--
You are receiving this mail because:
You are on the CC list for the bug.
1991
days inactive
1992
days old
java-sig-commits@lists.fedoraproject.org
9 comments
1 participants
participants (1)
-
bugzilla＠redhat.com