From 36335b3a60f1b2dd42e36b29a5f10268c4438c25 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 13 Mar 2025 19:17:50 +0000 Subject: [PATCH] Publish Advisories GHSA-5xm3-48v5-6h7v GHSA-fvfh-8mj3-23xj GHSA-mm9c-4cv4-7rfv GHSA-w3f5-gq7j-m797 GHSA-5xm3-48v5-6h7v GHSA-fvfh-8mj3-23xj GHSA-mm9c-4cv4-7rfv GHSA-w3f5-gq7j-m797 --- .../GHSA-5xm3-48v5-6h7v.json | 100 ++++++++++++++++++ .../GHSA-fvfh-8mj3-23xj.json | 88 +++++++++++++++ .../GHSA-mm9c-4cv4-7rfv.json | 92 ++++++++++++++++ .../GHSA-w3f5-gq7j-m797.json | 86 +++++++++++++++ .../GHSA-5xm3-48v5-6h7v.json | 47 -------- .../GHSA-fvfh-8mj3-23xj.json | 35 ------ .../GHSA-mm9c-4cv4-7rfv.json | 41 ------- .../GHSA-w3f5-gq7j-m797.json | 37 ------- 8 files changed, 366 insertions(+), 160 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json diff --git a/advisories/github-reviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json b/advisories/github-reviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json new file mode 100644 index 00000000000..79a88c0b402 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json @@ -0,0 +1,100 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5xm3-48v5-6h7v", + "modified": "2025-03-13T19:15:21Z", + "published": "2022-05-17T03:53:32Z", + "aliases": [ + "CVE-2014-3667" + ], + "summary": "Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code", + "details": "Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.566" + }, + { + "fixed": "1.583" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.565.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3667" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/f0a29b562e14d837912c6b35fa4e81478563813a" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHBA-2014:1630" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2014-3667" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1147770" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T19:15:21Z", + "nvd_published_at": "2014-10-16T19:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json b/advisories/github-reviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json new file mode 100644 index 00000000000..30ecad2f5e2 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fvfh-8mj3-23xj", + "modified": "2025-03-13T19:15:37Z", + "published": "2022-05-17T03:53:34Z", + "aliases": [ + "CVE-2014-3666" + ], + "summary": "Jenkins allows for Code Execution via Crafted Packet to the CLI", + "details": "Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.566" + }, + { + "fixed": "1.583" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.565.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3666" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/be195b0e19343bff6d966029d8eea99b2c039c32" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T19:15:37Z", + "nvd_published_at": "2014-10-16T19:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json b/advisories/github-reviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json new file mode 100644 index 00000000000..2211e508325 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mm9c-4cv4-7rfv", + "modified": "2025-03-13T19:15:04Z", + "published": "2022-05-17T03:53:32Z", + "aliases": [ + "CVE-2015-1806" + ], + "summary": "Jenkins allows for Privilege Escalation by Remote Authenticated Users", + "details": "The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.597" + }, + { + "fixed": "1.600" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.596.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1806" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2016:0070" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205620" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27" + }, + { + "type": "WEB", + "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T19:15:04Z", + "nvd_published_at": "2015-10-16T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json b/advisories/github-reviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json new file mode 100644 index 00000000000..4af6060cd3f --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json @@ -0,0 +1,86 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w3f5-gq7j-m797", + "modified": "2025-03-13T19:17:22Z", + "published": "2022-05-17T03:53:54Z", + "aliases": [ + "CVE-2014-2063" + ], + "summary": "Jenkins Vulnerable to Clickjacking", + "details": "Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.533" + }, + { + "fixed": "1.551" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.main:jenkins-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.532.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2063" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/jenkins/commit/16931bd7bf7560e26ef98328b8e95e803d0e90f6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/jenkins" + }, + { + "type": "WEB", + "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2014/02/21/2" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T19:17:22Z", + "nvd_published_at": "2014-10-17T15:55:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json b/advisories/unreviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json deleted file mode 100644 index f728561d51c..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-5xm3-48v5-6h7v/GHSA-5xm3-48v5-6h7v.json +++ /dev/null @@ -1,47 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-5xm3-48v5-6h7v", - "modified": "2022-05-17T03:53:32Z", - "published": "2022-05-17T03:53:32Z", - "aliases": [ - "CVE-2014-3667" - ], - "details": "Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3667" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHBA-2014:1630" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2014-3667" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1147770" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-10-16T19:55:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json b/advisories/unreviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json deleted file mode 100644 index 1d1ff1b73f2..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-fvfh-8mj3-23xj/GHSA-fvfh-8mj3-23xj.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fvfh-8mj3-23xj", - "modified": "2022-05-17T03:53:34Z", - "published": "2022-05-17T03:53:34Z", - "aliases": [ - "CVE-2014-3666" - ], - "details": "Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3666" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-10-16T19:55:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json b/advisories/unreviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json deleted file mode 100644 index d703850b54b..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-mm9c-4cv4-7rfv/GHSA-mm9c-4cv4-7rfv.json +++ /dev/null @@ -1,41 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-mm9c-4cv4-7rfv", - "modified": "2022-05-17T03:53:32Z", - "published": "2022-05-17T03:53:32Z", - "aliases": [ - "CVE-2015-1806" - ], - "details": "The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1806" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2016:0070" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205620" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27" - }, - { - "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2015-1844.html" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2015-10-16T20:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json b/advisories/unreviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json deleted file mode 100644 index f8921049b54..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-w3f5-gq7j-m797/GHSA-w3f5-gq7j-m797.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-w3f5-gq7j-m797", - "modified": "2022-05-17T03:53:54Z", - "published": "2022-05-17T03:53:54Z", - "aliases": [ - "CVE-2014-2063" - ], - "details": "Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2063" - }, - { - "type": "WEB", - "url": "https://github.com/jenkinsci/jenkins/commit/16931bd7bf7560e26ef98328b8e95e803d0e90f6" - }, - { - "type": "WEB", - "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2014/02/21/2" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-10-17T15:55:00Z" - } -} \ No newline at end of file