From owner-svn-ports-branches@FreeBSD.ORG Sun Mar 1 19:01:04 2015 Return-Path: Delivered-To: svn-ports-branches@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id A87EEFA0; Sun, 1 Mar 2015 19:01:04 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 8917C7D1; Sun, 1 Mar 2015 19:01:04 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t21J149X016434; Sun, 1 Mar 2015 19:01:04 GMT (envelope-from lwhsu@FreeBSD.org) Received: (from lwhsu@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t21J13C0016428; Sun, 1 Mar 2015 19:01:03 GMT (envelope-from lwhsu@FreeBSD.org) Message-Id: <201503011901.t21J13C0016428@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: lwhsu set sender to lwhsu@FreeBSD.org using -f From: Li-Wen Hsu Date: Sun, 1 Mar 2015 19:01:03 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Subject: svn commit: r380224 - in branches/2015Q1: devel/jenkins security/vuxml X-SVN-Group: ports-branches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-branches@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for all the branches of the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 01 Mar 2015 19:01:04 -0000 Author: lwhsu Date: Sun Mar 1 19:01:02 2015 New Revision: 380224 URL: https://svnweb.freebsd.org/changeset/ports/380224 QAT: https://qat.redports.org/buildarchive/r380224/ Log: MFH: r380172 Add entry for security issue in jenkins Reviewed by: zi MFH: r380173 - Update to 1.600 Security: 7480b6ac-adf1-443e-a33c-3a3c0becba1e Notified by: swills Approved by: portmgr (swills) Modified: branches/2015Q1/devel/jenkins/Makefile branches/2015Q1/devel/jenkins/distinfo branches/2015Q1/security/vuxml/vuln.xml Directory Properties: branches/2015Q1/ (props changed) Modified: branches/2015Q1/devel/jenkins/Makefile ============================================================================== --- branches/2015Q1/devel/jenkins/Makefile Sun Mar 1 18:56:56 2015 (r380223) +++ branches/2015Q1/devel/jenkins/Makefile Sun Mar 1 19:01:02 2015 (r380224) @@ -1,7 +1,7 @@ # $FreeBSD$ PORTNAME= jenkins -PORTVERSION= 1.595 +PORTVERSION= 1.600 CATEGORIES= devel java MASTER_SITES= http://mirrors.jenkins-ci.org/war/${PORTVERSION}/ DISTNAME= jenkins Modified: branches/2015Q1/devel/jenkins/distinfo ============================================================================== --- branches/2015Q1/devel/jenkins/distinfo Sun Mar 1 18:56:56 2015 (r380223) +++ branches/2015Q1/devel/jenkins/distinfo Sun Mar 1 19:01:02 2015 (r380224) @@ -1,2 +1,2 @@ -SHA256 (jenkins/1.595/jenkins.war) = 2424e6316ec45d524d132203438e8d767a5e9bed747b2c583047ff944f2e2935 -SIZE (jenkins/1.595/jenkins.war) = 68215690 +SHA256 (jenkins/1.600/jenkins.war) = 9b7d9d1fd6dce1077599a31468b1ef2ebe7b849f6d2f52f943541b944d9c29f9 +SIZE (jenkins/1.600/jenkins.war) = 68808007 Modified: branches/2015Q1/security/vuxml/vuln.xml ============================================================================== --- branches/2015Q1/security/vuxml/vuln.xml Sun Mar 1 18:56:56 2015 (r380223) +++ branches/2015Q1/security/vuxml/vuln.xml Sun Mar 1 19:01:02 2015 (r380224) @@ -57,6 +57,79 @@ Notes: --> + + jenkins -- multiple vulnerabilities + + + jenkins + 1.600 + + + jenkins-lts + 1.580.3 + + + + +

Kohsuke Kawaguchi from Jenkins team reports:

+
+

Description

+
SECURITY-125 (Combination filter Groovy script unsecured)
+

This vulnerability allows users with the job configuration + privilege to escalate his privileges, resulting in arbitrary code + execution to the master.

+
SECURITY-162 (directory traversal from artifacts via symlink)
+

This vulnerability allows users with the job configuration + privilege or users with commit access to the build script to + access arbitrary files/directories on the master, resulting in + the exposure of sensitive information, such as encryption keys.

+
SECURITY-163 (update center metadata retrieval DoS attack)
+

This vulnerability allows authenticated users to disrupt the + operation of Jenkins by feeding malicious update center data into + Jenkins, affecting plugin installation and tool installation.

+
SECURITY-165 (external entity injection via XPath)
+

This vulnerability allows users with the read access to Jenkins + to retrieve arbitrary XML document on the server, resulting in + the exposure of sensitive information inside/outside Jenkins.

+
SECURITY-166 (HudsonPrivateSecurityRealm allows creation of + reserved names)
+

For users using "Jenkins' own user database" setting, Jenkins + doesn't refuse reserved names, thus allowing privilege escalation.

+
SECURITY-167 (External entity processing in XML can reveal + sensitive local files)
+

This vulnerability allows attackers to create malicious XML + documents and feed that into Jenkins, which causes Jenkins to + retrieve arbitrary XML document on the server, resulting in the + exposure of sensitive information inside/outside Jenkins.

+

Severity

+

SECURITY-125 is rated critical. This attack can be + only mounted by users with some trust, but it results in arbitrary + code execution on the master.

+

SECURITY-162 is rated critical. This attack can be + only mounted by users with some trust, but it results in the + exposure of sensitive information.

+

SECURITY-163 is rated medium, as it results in the + loss of functionality.

+

SECURITY-165 is rated critical. This attack is + easy to mount, and it results in the exposure of sensitive + information.

+

SECURITY-166 is rated critical. For users who use + the affected feature, this attack results in arbitrary code + execution on the master.

+

SECURITY-167 is rated critical. This attack is + easy to mount, and it results in the exposure of sensitive information.

+
+ + + + https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 + + + 2015-03-01 + 2015-03-01 + + + django -- multiple vulnerabilities