CVE-2014-9634
First published: Fri Jan 23 2015(Updated: )
Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Jenkins | <=1.585 | |
| Apache Tomcat | =7.0.41 | |
| Apache Tomcat | =7.0.42 | |
| Apache Tomcat | =7.0.43 | |
| Apache Tomcat | =7.0.44 | |
| Apache Tomcat | =7.0.45 | |
| Apache Tomcat | =7.0.46 | |
| Apache Tomcat | =7.0.47 | |
| Apache Tomcat | =7.0.48 | |
| Apache Tomcat | =7.0.49 | |
| Apache Tomcat | =7.0.50 | |
| Apache Tomcat | =7.0.51 | |
| Apache Tomcat | =7.0.54 | |
| Apache Tomcat | =7.0.55 | |
| Apache Tomcat | =7.0.56 | |
| Apache Tomcat | =7.0.57 | |
| Apache Tomcat | =7.0.58 | |
| Apache Tomcat | =7.0.59 | |
| Apache Tomcat | =7.0.60 | |
| Apache Tomcat | =7.0.61 | |
| Apache Tomcat | =7.0.62 | |
| Apache Tomcat | =7.0.63 | |
| Apache Tomcat | =7.0.64 | |
| Apache Tomcat | =7.0.65 | |
| Apache Tomcat | =7.0.66 | |
| Apache Tomcat | =7.0.67 | |
| Apache Tomcat | =7.0.68 | |
| Apache Tomcat | =7.0.69 | |
| Apache Tomcat | =7.0.70 | |
| Apache Tomcat | =7.0.71 | |
| Apache Tomcat | =7.0.72 | |
| Apache Tomcat | =7.0.73 | |
| Apache Tomcat | =7.0.74 | |
| Apache Tomcat | =7.0.75 | |
| Apache Tomcat | =7.0.76 | |
| Apache Tomcat | =7.0.77 | |
| Apache Tomcat | =7.0.78 | |
| Apache Tomcat | =7.0.79 | |
| Apache Tomcat | =7.0.80 | |
| Apache Tomcat | =7.0.81 | |
| maven/org.jenkins-ci.main:jenkins-core | <1.586 | 1.586 |
| All of | ||
| Jenkins Jenkins | <=1.585 | |
| Any of | ||
| Apache Tomcat | =7.0.41 | |
| Apache Tomcat | =7.0.42 | |
| Apache Tomcat | =7.0.43 | |
| Apache Tomcat | =7.0.44 | |
| Apache Tomcat | =7.0.45 | |
| Apache Tomcat | =7.0.46 | |
| Apache Tomcat | =7.0.47 | |
| Apache Tomcat | =7.0.48 | |
| Apache Tomcat | =7.0.49 | |
| Apache Tomcat | =7.0.50 | |
| Apache Tomcat | =7.0.51 | |
| Apache Tomcat | =7.0.54 | |
| Apache Tomcat | =7.0.55 | |
| Apache Tomcat | =7.0.56 | |
| Apache Tomcat | =7.0.57 | |
| Apache Tomcat | =7.0.58 | |
| Apache Tomcat | =7.0.59 | |
| Apache Tomcat | =7.0.60 | |
| Apache Tomcat | =7.0.61 | |
| Apache Tomcat | =7.0.62 | |
| Apache Tomcat | =7.0.63 | |
| Apache Tomcat | =7.0.64 | |
| Apache Tomcat | =7.0.65 | |
| Apache Tomcat | =7.0.66 | |
| Apache Tomcat | =7.0.67 | |
| Apache Tomcat | =7.0.68 | |
| Apache Tomcat | =7.0.69 | |
| Apache Tomcat | =7.0.70 | |
| Apache Tomcat | =7.0.71 | |
| Apache Tomcat | =7.0.72 | |
| Apache Tomcat | =7.0.73 | |
| Apache Tomcat | =7.0.74 | |
| Apache Tomcat | =7.0.75 | |
| Apache Tomcat | =7.0.76 | |
| Apache Tomcat | =7.0.77 | |
| Apache Tomcat | =7.0.78 | |
| Apache Tomcat | =7.0.79 | |
| Apache Tomcat | =7.0.80 | |
| Apache Tomcat | =7.0.81 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2015/01/22/3
- http://www.securityfocus.com/bid/72054
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682
- https://bugzilla.redhat.com/show_bug.cgi?id=1185148
- https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710
- https://issues.jenkins-ci.org/browse/JENKINS-25019
- https://jenkins.io/changelog-old/
- https://nvd.nist.gov/vuln/detail/CVE-2014-9634
- https://github.com/advisories/GHSA-g7cf-wg27-qw87 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1185152
- https://access.redhat.com/security/updates/classification/
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-g7cf-wg27-qw87
- alias/CVE-2014-9634
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- agent/remedy
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/description
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- agent/event
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/jenkins
- canonical/jenkins jenkins
- version/jenkins jenkins/1.585
- vendor/apache
- canonical/apache tomcat
- version/apache tomcat/7.0.41
- version/apache tomcat/7.0.42
- version/apache tomcat/7.0.43
- version/apache tomcat/7.0.44
- version/apache tomcat/7.0.45
- version/apache tomcat/7.0.46
- version/apache tomcat/7.0.47
- version/apache tomcat/7.0.48
- version/apache tomcat/7.0.49
- version/apache tomcat/7.0.50
- version/apache tomcat/7.0.51
- version/apache tomcat/7.0.54
- version/apache tomcat/7.0.55
- version/apache tomcat/7.0.56
- version/apache tomcat/7.0.57
- version/apache tomcat/7.0.58
- version/apache tomcat/7.0.59
- version/apache tomcat/7.0.60
- version/apache tomcat/7.0.61
- version/apache tomcat/7.0.62
- version/apache tomcat/7.0.63
- version/apache tomcat/7.0.64
- version/apache tomcat/7.0.65
- version/apache tomcat/7.0.66
- version/apache tomcat/7.0.67
- version/apache tomcat/7.0.68
- version/apache tomcat/7.0.69
- version/apache tomcat/7.0.70
- version/apache tomcat/7.0.71
- version/apache tomcat/7.0.72
- version/apache tomcat/7.0.73
- version/apache tomcat/7.0.74
- version/apache tomcat/7.0.75
- version/apache tomcat/7.0.76
- version/apache tomcat/7.0.77
- version/apache tomcat/7.0.78
- version/apache tomcat/7.0.79
- version/apache tomcat/7.0.80
- version/apache tomcat/7.0.81
- package-manager/maven