kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Document Jenkins vulnerabilities

Browse source
This commit is contained in:
Steve Wills 2018-04-12 17:54:28 +00:00
parent 8e017e1d0e
commit 07dfa53347
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=467175
1 changed files with 41 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

41
security/vuxml/vuln.xml
View file

@ -58,6 +58,47 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="aaba17aa-782e-4843-8a79-7756cfa2bf89">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.115</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.107.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins developers report:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-04-11/">
<p>The Jenkins CLI sent different error responses for commands with
view and agent arguments depending on the existence of the specified
views or agents to unauthorized users. This allowed attackers to
determine whether views or agents with specified names exist.</p>
<p>The Jenkins CLI now returns the same error messages to unauthorized
users independent of the existence of specified view or agent
names</p>
<p>Some JavaScript confirmation dialogs included the item name in an
unsafe manner, resulting in a possible cross-site scripting
vulnerability exploitable by users with permission to create or
configure items.</p>
<p>JavaScript confirmation dialogs that include the item name now
properly escape it, so it can be safely displayed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-04-11/</url>
</references>
<dates>
<discovery>2018-04-11</discovery>
<entry>2018-04-12</entry>
</dates>
</vuln>
<vuln vid="5c6f7482-3ced-11e8-b157-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>