user data security issues in Jenkins
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
jenkins (Debian) |
Fix Released
|
Unknown
|
|||
jenkins (Ubuntu) |
Fix Released
|
High
|
Unassigned | ||
Oneiric |
Won't Fix
|
Undecided
|
Unassigned | ||
Precise |
Fix Released
|
High
|
Unassigned | ||
Quantal |
Fix Released
|
High
|
Unassigned |
Bug Description
As reported here:
http://
The first vulnerability in Jenkins core allows unprivileged users to insert data into Jenkins master, which can lead to remote code execution. For this vulnerability to be exploited, the attacker must have an HTTP access to a Jenkins master, and he must have a read access to Jenkins.
The second vulnerability in Jenkins core is a cross-site scripting vulnerability. This allows an attacker to craft a URL that points to Jenkins, and if a legitimate user clicks this link, the attacker will be able to hijack the user session.
ProblemType: Bug
DistroRelease: Ubuntu 12.10
Package: jenkins (not installed)
ProcVersionSign
Uname: Linux 3.5.0-15-generic x86_64
ApportVersion: 2.5.2-0ubuntu4
Architecture: amd64
Date: Mon Sep 24 11:31:54 2012
SourcePackage: jenkins
UpgradeStatus: Upgraded to quantal on 2012-06-11 (105 days ago)
upstart.
Related branches
Changed in jenkins (Debian): | |
status: | Unknown → Fix Released |
Already fixed in quantal (1.466.2).
I've contact upstream for guidance on resolving this issue in the version for oneiric and precise; prior security issues have been easy to cherry pick but these two are not obvious.