Jenkins does not Verify Checksums for Plugin Files
The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2015-7539US | high7.5OT erhöht | — | ||
The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-m… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://rhn.redhat.com/errata/RHSA-2016-0489.htmlWEB
- https://access.redhat.com/errata/RHSA-2016:0070WEB
- https://github.com/jenkinsci/jenkinsPACKAGE
- https://github.com/jenkinsci/jenkins/commit/11479a2cc0a322a6bcd7e65667f3d24aa4d444bbWEB
- https://github.com/jenkinsci/jenkins/commit/97adb71aa4509f91e408a16ba312e817ec015cf4WEB
- https://github.com/jenkinsci/jenkins/commit/9ec88357a354d8354728cc06e2b8c8b68aee58bfWEB
- https://github.com/jenkinsci/jenkins/commit/c158648afa8888bc49ac337c973d4e4bc050118eWEB
- https://github.com/jenkinsci/jenkins/commit/f99cb46e06f394637067730a82f46bddc3567295WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan