mailing list archives
Jenkins CVE request for Jenkins Security Advisory 2013-02-16
From: Kurt Seifried <kseifried () redhat com>
Date: Sun, 17 Feb 2013 19:56:40 -0700
-----BEGIN PGP SIGNED MESSAGE-----
I'm trying to sort out this security advisory so CVE #'s can be
assigned to it, can you (kk@) please comment on this? thanks.
One of the vulnerabilities allows cross-site request forgery (CSRF)
attacks on Jenkins master, which causes an user to make unwanted
actions on Jenkins.
Another vulnerability enables cross-site scripting (XSS) attacks,
which has the similar consequence.
Another vulnerability allowed an attacker to bypass the CSRF
protection mechanism in place, thereby mounting more CSRF attackes.
These attacks allow an attacker without direct access to Jenkins to
mount an attack.
In the fourth vulnerability, a malicious user of Jenkins can trick
Jenkins into building jobs that he does not have direct access to.
And lastly, a vulnerability allows a malicious user of Jenkins to
mount a denial of service attack by feeding a carefully crafted
payload to Jenkins.
So it sounds like 2 CSRF, 1 XSS, 1 "can trick Jenkins into building
jobs that he does not have direct access to" (permissions bypass?) and
a denial of service.
The 2 CSRF ones, were they discovered by separate researchers or the
same person? Can you provide the code patches that fix them so I can
see more details? Thanks.
Also if you want to get CVE #'s for Jenkins advisories please do not
hesitate to contact me/secalert () redhat com, this will make tracking
these issues a lot easier!
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
-----END PGP SIGNATURE-----
- Jenkins CVE request for Jenkins Security Advisory 2013-02-16 Kurt Seifried (Feb 18)