oss-security - Jenkins CVE request for Jenkins Security Advisory 2013-02-16

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun, 17 Feb 2013 19:56:40 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
        kk@...suke.org
Subject: Jenkins CVE request for Jenkins Security Advisory 2013-02-16

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I'm trying to sort out this security advisory so CVE #'s can be
assigned to it, can you (kk@) please comment on this? thanks.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16

==============
One of the vulnerabilities allows cross-site request forgery (CSRF)
attacks on Jenkins master, which causes an user to make unwanted
actions on Jenkins.

Another vulnerability enables cross-site scripting (XSS) attacks,
which has the similar consequence.

Another vulnerability allowed an attacker to bypass the CSRF
protection mechanism in place, thereby mounting more CSRF attackes.
These attacks allow an attacker without direct access to Jenkins to
mount an attack.

In the fourth vulnerability, a malicious user of Jenkins can trick
Jenkins into building jobs that he does not have direct access to.

And lastly, a vulnerability allows a malicious user of Jenkins to
mount a denial of service attack by feeding a carefully crafted
payload to Jenkins.
================

So it sounds like 2 CSRF, 1 XSS, 1 "can trick Jenkins into building
jobs that he does not have direct access to" (permissions bypass?) and
a denial of service.

The 2 CSRF ones, were they discovered by separate researchers or the
same person? Can you provide the code patches that fix them so I can
see more details? Thanks.

Also if you want to get CVE #'s for Jenkins advisories please do not
hesitate to contact me/secalert@...hat.com, this will make tracking
these issues a lot easier!

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRIZhoAAoJEBYNRVNeJnmTlrIP/23i8gBuaR+Aaswxgj90+Goa
slw1CGNbgt0BT6ABqUrpKgidkB/g20xa0dKL6X0gdu5qdDxTJ7aJ3dkhAlSQeD9w
zNItfmU37NyDaZJ8PW+B05kNkijLMPnsJM7emKC6WsLO3K3iHQgYqS1t7/Oz33gA
f3mnfeRYsH7s1nuW44710JhCk0BIW5cmado9CM3xwioXahDyWKc5MPs9/7FyNSVj
LzjM2Z8Inwu5bk1HoS9E7dCvBTq9oCre3KiLfEWOrQSLXu9uE/yVVmcTzfMKP+QT
Jw1cRUK2SjpeC/yu+A/0ZaE5JgT7xy4QguprHwjaYHwklAq+TTE6MuJa/pgd6urc
0gbnPIWMldNndvS+GJFshuoTO7T4/A7dfbuzGxdECfFaYUzNEXx4UxL9VPzxYXI0
98Bl1agTc/I2BMkg8K77jRfAhVhd9nPG8wdXxu3wG8oQm5bp9tUyDUu6Hsgs56AY
7PoDxlzkZtD5XyoxEyktW6mz/rz3U0lZvN1TuXy5bxNRAxjXMH7TyKZ1bbodykae
ZWM7ZJHo5H/F96jKtq/SrF8d6Zd+rQ98Lam2urH6C2z6YCZgt5MHuNAF8li5mjEZ
sw4adnNKKc635j8pZVEf9gjlBNuXB5nKg5XIWHfyHpXY4TnicUMGAsFVBafcFm1Z
ZoPZscPPjk6ygGSnyPga
=wF04
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.