From owner-svn-ports-head@FreeBSD.ORG Sat Feb 15 08:04:52 2014 Return-Path: Delivered-To: svn-ports-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 64057805; Sat, 15 Feb 2014 08:04:52 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 3F84E10D7; Sat, 15 Feb 2014 08:04:52 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.8/8.14.8) with ESMTP id s1F84qig092253; Sat, 15 Feb 2014 08:04:52 GMT (envelope-from lwhsu@svn.freebsd.org) Received: (from lwhsu@localhost) by svn.freebsd.org (8.14.8/8.14.8/Submit) id s1F84pca092252; Sat, 15 Feb 2014 08:04:51 GMT (envelope-from lwhsu@svn.freebsd.org) Message-Id: <201402150804.s1F84pca092252@svn.freebsd.org> From: Li-Wen Hsu Date: Sat, 15 Feb 2014 08:04:51 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r344327 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 15 Feb 2014 08:04:52 -0000 Author: lwhsu Date: Sat Feb 15 08:04:51 2014 New Revision: 344327 URL: http://svnweb.freebsd.org/changeset/ports/344327 QAT: https://qat.redports.org/buildarchive/r344327/ Log: Document Jenkins Security Advisory 2014-02-14 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat Feb 15 07:51:11 2014 (r344326) +++ head/security/vuxml/vuln.xml Sat Feb 15 08:04:51 2014 (r344327) @@ -51,6 +51,137 @@ Note: Please add new entries to the beg --> + + jenkins -- multiple vulnerabilities + + + jenkins + 1.551 + + + jenkins-lts + 1.532.2 + + + + +

Jenkins Security Advisory reports:

+
This advisory announces multiple security vulnerabilities that + were found in Jenkins core.
+
+
+
iSECURITY-105
+
In some places, Jenkins XML API uses XStream to deserialize + arbitrary content, which is affected by CVE-2013-7285 reported + against XStream. This allows malicious users of Jenkins with + a limited set of permissions to execute arbitrary code inside + Jenkins master.
+
+
+
SECURITY-76 & SECURITY-88 / CVE-2013-5573
+
Restrictions of HTML tags for user-editable contents are too + lax. This allows malicious users of Jenkins to trick other + unsuspecting users into providing sensitive information.
+
+
+
SECURITY-109
+
Plugging a hole in the earlier fix to SECURITY-55. Under some + circimstances, a malicious user of Jenkins can configure job + X to trigger another job Y that the user has no access to.
+
+
+
SECURITY-108
+
CLI job creation had a directory traversal vulnerability. This + allows a malicious user of Jenkins with a limited set of + permissions to overwrite files in the Jenkins master and + escalate privileges.
+
+
+
SECURITY-106
+
The embedded Winstone servlet container is susceptive to + session hijacking attack.
+
+
+
SECURITY-93
+
The password input control in the password parameter + definition in the Jenkins UI was serving the actual value of + the password in HTML, not an encrypted one. If a sensitive + value is set as the default value of such a parameter + definition, it can be exposed to unintended audience.
+
+
+
SECURITY-89
+
Deleting the user was not invalidating the API token, + allowing users to access Jenkins when they shouldn't be + allowed to do so.
+
+
+
SECURITY-80
+
Jenkins UI was vulnerable to click jacking attacks.
+
+
+
SECURITY-79
+
"Jenkins' own user database" was revealing the + presence/absence of users when login attempts fail.
+
+
+
SECURITY-77
+
Jenkins had a cross-site scripting vulnerability in one of its + cookies. If Jenkins is deployed in an environment that allows + an attacker to override Jenkins cookies in victim's browser, + this vulnerability can be exploited.
+
+
+
SECURITY-75
+
Jenkins was vulnerable to session fixation attack. If Jenkins + is deployed in an environment that allows an attacker to + override Jenkins cookies in victim's browser, this + vulnerability can be exploited.
+
+
+
SECURITY-74
+
Stored XSS vulnerability. A malicious user of Jenkins with a + certain set of permissions can cause Jenkins to store + arbitrary HTML fragment.
+
+
+
SECURITY-73
+
Some of the system diagnostic functionalities were checking a + lesser permission than it should have. In a very limited + circumstances, this can cause an attacker to gain information + that he shouldn't have access to.
+
+
+
Severity
+
+
SECURITY-106, and SECURITY-80 are rated high. An attacker only + needs direct HTTP access to the server to mount this attack.
+
SECURITY-105, SECURITY-109, SECURITY-108, and SECURITY-74 are + rated high. These vulnerabilities allow attackes with valid + Jenkins user accounts to escalate privileges in various ways.
+
SECURITY-76, SECURIT-88, and SECURITY-89 are rated medium. + These vulnerabilities requires an attacker to be an user of + Jenkins, and the mode of the attack is limited.
+
SECURITY-93, and SECURITY-79 are rated low. These + vulnerabilities only affect a small part of Jenkins and has + limited impact.
+
SECURITY-77, SECURITY-75, and SECURITY-73 are rated low. These + vulnerabilities are hard to exploit unless combined with other + exploit in the network.
+
+

+ + + + https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 + + + 2014-02-14 + 2014-02-15 + + + lighttpd -- multiple vulnerabilities