Ubuntu
jenkins package

user data security issues in Jenkins

Bug #1055416 reported by James Page on 2012-09-24

256

This bug affects 1 person

	Status	Importance	Assigned to
jenkins (Debian)	Fix Released	Unknown	debbugs #688298
jenkins (Ubuntu)	Fix Released	High	Unassigned
Oneiric	Won't Fix	Undecided	Unassigned
Precise	Fix Released	High	Unassigned
Quantal	Fix Released	High	Unassigned

Bug Description

As reported here:

http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-09-17.cb

The first vulnerability in Jenkins core allows unprivileged users to insert data into Jenkins master, which can lead to remote code execution. For this vulnerability to be exploited, the attacker must have an HTTP access to a Jenkins master, and he must have a read access to Jenkins.

The second vulnerability in Jenkins core is a cross-site scripting vulnerability. This allows an attacker to craft a URL that points to Jenkins, and if a legitimate user clicks this link, the attacker will be able to hijack the user session.

ProblemType: Bug
DistroRelease: Ubuntu 12.10
Package: jenkins (not installed)
ProcVersionSignature: Ubuntu 3.5.0-15.22-generic 3.5.4
Uname: Linux 3.5.0-15-generic x86_64
ApportVersion: 2.5.2-0ubuntu4
Architecture: amd64
Date: Mon Sep 24 11:31:54 2012
SourcePackage: jenkins
UpgradeStatus: Upgraded to quantal on 2012-06-11 (105 days ago)
upstart.jenkins.override: manual

Tags:

Related branches

lp:ubuntu/precise-security/jenkins

CVE References

Revision history for this message

James Page (james-page) wrote on 2012-09-24:

ProcEnviron.txt Edit (291 bytes, text/plain; charset="utf-8")

security vulnerability:	no → yes
Changed in jenkins (Ubuntu Quantal):
status:	New → Fix Released
importance:	Undecided → High

Revision history for this message

James Page (james-page) wrote on 2012-09-24:

Already fixed in quantal (1.466.2).

I've contact upstream for guidance on resolving this issue in the version for oneiric and precise; prior security issues have been easy to cherry pick but these two are not obvious.

Changed in jenkins (Ubuntu Precise):
importance:	Undecided → High

Revision history for this message

James Page (james-page) wrote on 2012-09-25:

jenkins_1.424.6+dfsg-1ubuntu0.1.debdiff Edit (28.2 KiB, text/plain)

Update for precise; same set of upstream commits as in 1.466.2 but rebased against 1.424.6 codebase.

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2012-09-26:

Thanks for the debdiff! I don't seem to be able to verify the upstream patch, but in general, it looks ok (there was a typo in the patch metadata, but I fixed that).

Changed in jenkins (Ubuntu Precise):
status:	New → In Progress

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2012-09-26:

In terms of testing, the testsuite passes with no added failures, errors or skipped tests. James, is the testsuite good enough for publishing to the archive or would you like me to make these packages available to you?

Revision history for this message

James Page (james-page) wrote on 2012-09-26:

Jamie - I'll give them a sniff if thats OK with you.

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2012-09-26:

Ok, uploaded to https://launchpad.net/~ubuntu-security-proposed/+archive/ppa/+packages. Please test and give feedback here.

Revision history for this message

James Page (james-page) wrote on 2012-09-28:

Hi Jamie

I gave the package in the PPA a good test this evening - all looks OK to me.

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2012-10-01:

Thanks!

Changed in jenkins (Ubuntu Oneiric):
status:	New → Triaged

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-10-01:

#10

This bug was fixed in the package jenkins - 1.424.6+dfsg-1ubuntu0.1

---------------
jenkins (1.424.6+dfsg-1ubuntu0.1) precise-security; urgency=low

  * SECURITY UPDATE: Remote code execution and XSS vulnerabilities
    in Jenkins core (LP: #1055416):
    - d/p/security/CVE-2012-4438_CVE-2012-4439.patch: Cherry picked
      fixes from 1.466.2 release to resolve remote code execution
      and XSS security vulnerabilities.
    - http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-09-17.cb
    - CVE-2012-4438
    - CVE-2012-4439
-- James Page <email address hidden> Tue, 25 Sep 2012 13:32:05 +0100

Changed in jenkins (Ubuntu Precise):
status:	In Progress → Fix Released

Bug Watch Updater (bug-watch-updater) on 2012-10-04

Changed in jenkins (Debian):
status:	Unknown → Fix Released

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2013-11-12:

#11

Thank you for reporting this bug to Ubuntu. oneiric has reached EOL
(End of Life) for this package and is no longer supported. As
a result, this bug against oneiric is being marked "Won't Fix".
Please see https://wiki.ubuntu.com/Releases for currently
supported Ubuntu releases.

Please feel free to report any other bugs you may find.