Jenkins secure flag not set on session cookies
Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2014-9634US | medium5.3 | — | ||
Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepti… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2015/01/22/3WEB
- http://www.securityfocus.com/bid/72054WEB
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1185148WEB
- https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710WEB
- https://issues.jenkins-ci.org/browse/JENKINS-25019WEB
- https://jenkins.io/changelog-oldWEB
- https://nvd.nist.gov/vuln/detail/CVE-2014-9634ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan