Jenkins secure flag not set on session cookies
Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-9634US | medium5.3 | — | ||
Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepti… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2015/01/22/3WEB
- http://www.securityfocus.com/bid/72054WEB
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1185148WEB
- https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710WEB
- https://issues.jenkins-ci.org/browse/JENKINS-25019WEB
- https://jenkins.io/changelog-oldWEB
- https://nvd.nist.gov/vuln/detail/CVE-2014-9634ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan