Red Hat Bug Fix Advisory: Red Hat OpenShift Enterprise 2.1 jenkins-plugin-openshift bug fix update

Fixed packages 3

Vulnerabilities 22

• Low —
  CVE-2013-5573 Public exploit

  Jenkins allows Cross-Site Scripting (XSS) in User Configuration

  Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.

  org.jenkins-ci.main:jenkins-core Maven
  Dec 31, 2013
• Medium —
  CVE-2013-6372

  Jenkins Subversion Plugin Stores Credentials with Base64 Encoding

  The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.

  org.jenkins-ci.plugins:subversion Maven
  May 8, 2014
• Medium —
  CVE-2013-7330

  Jenkins allows attackers to configure restricted projects

  Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 17, 2014
• Medium —
  CVE-2014-2059

  Jenkins directory traversal vulnerability

  Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name.

  org.jenkins-ci.main:jenkins-core Maven
  Feb 28, 2014
• Medium —
  CVE-2014-2060

  Jenkins allows Remote Attackers to Hijack Sessions

  The Winstone servlet container in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack sessions via unspecified vectors.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 17, 2014
• Medium —
  CVE-2014-2061

  Jenkin allows attackers to obtain passwords by reading the HTML source code

  The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 17, 2014
• Medium —
  CVE-2014-2062

  Jenkins does not invalidate the API token when a user is deleted

  Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 17, 2014
• Medium —
  CVE-2014-2063

  Jenkins Vulnerable to Clickjacking

  Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 17, 2014
• Medium —
  CVE-2014-2064 Public exploit

  Jenkins allows attackers to determine whether a user exists

  The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 17, 2014
• Medium —
  CVE-2014-2065

  Jenkins cross-site scripting (XSS) vulnerability

  Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 17, 2014
• Medium —
  CVE-2014-2066

  Jenkins session fixation vulnerability

  Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 17, 2014
• Medium —
  CVE-2014-2067

  Jenkins cross-site scripting (XSS) vulnerability

  Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."

  org.jenkins-ci.main:jenkins-core Maven
  Feb 28, 2014
• Low —
  CVE-2014-2068

  Jenkins allows attackers to obtain sensitive information

  The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 17, 2014
• Medium —
  CVE-2014-3661

  Jenkins Denial of Service vulnerability

  Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 16, 2014
• Medium —
  CVE-2014-3662

  Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability

  Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 16, 2014
• Medium —
  CVE-2014-3663

  Jenkins allows remote authenticated users to bypass intended restrictions and create or destroy arbitrary jobs

  Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs via unspecified vectors.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 16, 2014
• Medium —
  CVE-2014-3664

  Jenkins Path Traversal vulnerability

  Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 15, 2014
• Medium —
  CVE-2014-3665

  Jenkins improperly ensures trust separation

  Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave.

  org.jenkins-ci.main:jenkins-core Maven
  Nov 25, 2015
• Medium —
  CVE-2014-3666

  Jenkins allows for Code Execution via Crafted Packet to the CLI

  Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 16, 2014
• Medium —
  CVE-2014-3667

  Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code

  Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 16, 2014
• Medium —
  CVE-2014-3678

  Jenkins Monitoring Plugin allows Cross-Site Scripting (XSS)

  Cross-site scripting (XSS) vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  org.jvnet.hudson.plugins:monitoring Maven
  Oct 10, 2014
• Medium —
  CVE-2014-3681

  Jenkins Cross-site Scripting vulnerability

  Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  org.jenkins-ci.main:jenkins-core Maven
  Oct 15, 2014

References

• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1127667
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhba-2014_1630.json
• report
  https://access.redhat.com/security/cve/CVE-2013-5573
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1044976
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-5573
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-5573
• report
  https://access.redhat.com/security/cve/CVE-2013-6372
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1032391
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-6372
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-6372
• report
  https://access.redhat.com/security/cve/CVE-2013-7330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1067799
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-7330
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-7330
• report
  https://access.redhat.com/security/cve/CVE-2014-2059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1067801
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-2059
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-2059
• report
  https://access.redhat.com/security/cve/CVE-2014-2060
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1067806
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-2060
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-2060
• report
  https://access.redhat.com/security/cve/CVE-2014-2061
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1067808
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-2061
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-2061
• report
  https://access.redhat.com/security/cve/CVE-2014-2062
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1067811
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-2062
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-2062
• report
  https://access.redhat.com/security/cve/CVE-2014-2063
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1067812
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-2063
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-2063
• report
  https://access.redhat.com/security/cve/CVE-2014-2064
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1067817
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-2064
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-2064
• report
  https://access.redhat.com/security/cve/CVE-2014-2065