CVE-2014-9635
First published: Fri Jan 23 2015(Updated: )
Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Jenkins | <=1.585 | |
| Apache Tomcat | =7.0.41 | |
| Apache Tomcat | =7.0.42 | |
| Apache Tomcat | =7.0.43 | |
| Apache Tomcat | =7.0.44 | |
| Apache Tomcat | =7.0.45 | |
| Apache Tomcat | =7.0.46 | |
| Apache Tomcat | =7.0.47 | |
| Apache Tomcat | =7.0.48 | |
| Apache Tomcat | =7.0.49 | |
| Apache Tomcat | =7.0.50 | |
| Apache Tomcat | =7.0.51 | |
| Apache Tomcat | =7.0.54 | |
| Apache Tomcat | =7.0.55 | |
| Apache Tomcat | =7.0.56 | |
| Apache Tomcat | =7.0.57 | |
| Apache Tomcat | =7.0.58 | |
| Apache Tomcat | =7.0.59 | |
| Apache Tomcat | =7.0.60 | |
| Apache Tomcat | =7.0.61 | |
| Apache Tomcat | =7.0.62 | |
| Apache Tomcat | =7.0.63 | |
| Apache Tomcat | =7.0.64 | |
| Apache Tomcat | =7.0.65 | |
| Apache Tomcat | =7.0.66 | |
| Apache Tomcat | =7.0.67 | |
| Apache Tomcat | =7.0.68 | |
| Apache Tomcat | =7.0.69 | |
| Apache Tomcat | =7.0.70 | |
| Apache Tomcat | =7.0.71 | |
| Apache Tomcat | =7.0.72 | |
| Apache Tomcat | =7.0.73 | |
| Apache Tomcat | =7.0.74 | |
| Apache Tomcat | =7.0.75 | |
| Apache Tomcat | =7.0.76 | |
| Apache Tomcat | =7.0.77 | |
| Apache Tomcat | =7.0.78 | |
| Apache Tomcat | =7.0.79 | |
| Apache Tomcat | =7.0.80 | |
| Apache Tomcat | =7.0.81 | |
| maven/org.jenkins-ci.main:jenkins-core | <1.586 | 1.586 |
| All of | ||
| Jenkins Jenkins | <=1.585 | |
| Any of | ||
| Apache Tomcat | =7.0.41 | |
| Apache Tomcat | =7.0.42 | |
| Apache Tomcat | =7.0.43 | |
| Apache Tomcat | =7.0.44 | |
| Apache Tomcat | =7.0.45 | |
| Apache Tomcat | =7.0.46 | |
| Apache Tomcat | =7.0.47 | |
| Apache Tomcat | =7.0.48 | |
| Apache Tomcat | =7.0.49 | |
| Apache Tomcat | =7.0.50 | |
| Apache Tomcat | =7.0.51 | |
| Apache Tomcat | =7.0.54 | |
| Apache Tomcat | =7.0.55 | |
| Apache Tomcat | =7.0.56 | |
| Apache Tomcat | =7.0.57 | |
| Apache Tomcat | =7.0.58 | |
| Apache Tomcat | =7.0.59 | |
| Apache Tomcat | =7.0.60 | |
| Apache Tomcat | =7.0.61 | |
| Apache Tomcat | =7.0.62 | |
| Apache Tomcat | =7.0.63 | |
| Apache Tomcat | =7.0.64 | |
| Apache Tomcat | =7.0.65 | |
| Apache Tomcat | =7.0.66 | |
| Apache Tomcat | =7.0.67 | |
| Apache Tomcat | =7.0.68 | |
| Apache Tomcat | =7.0.69 | |
| Apache Tomcat | =7.0.70 | |
| Apache Tomcat | =7.0.71 | |
| Apache Tomcat | =7.0.72 | |
| Apache Tomcat | =7.0.73 | |
| Apache Tomcat | =7.0.74 | |
| Apache Tomcat | =7.0.75 | |
| Apache Tomcat | =7.0.76 | |
| Apache Tomcat | =7.0.77 | |
| Apache Tomcat | =7.0.78 | |
| Apache Tomcat | =7.0.79 | |
| Apache Tomcat | =7.0.80 | |
| Apache Tomcat | =7.0.81 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682
- https://issues.jenkins-ci.org/browse/JENKINS-25019
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1185152
- https://access.redhat.com/security/updates/classification/
- https://bugzilla.redhat.com/show_bug.cgi?id=1185151
- http://www.openwall.com/lists/oss-security/2015/01/22/3
- http://www.securityfocus.com/bid/72054
- https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710
- https://jenkins.io/changelog-old/
- https://nvd.nist.gov/vuln/detail/CVE-2014-9635
- https://github.com/advisories/GHSA-7f6w-fhmr-j8hq (Advisory)
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-7f6w-fhmr-j8hq
- alias/CVE-2014-9635
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- agent/remedy
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/description
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- agent/event
- collector/github-advisory
- agent/trending
- agent/tags
- agent/source
- vendor/jenkins
- canonical/jenkins jenkins
- version/jenkins jenkins/1.585
- vendor/apache
- canonical/apache tomcat
- version/apache tomcat/7.0.41
- version/apache tomcat/7.0.42
- version/apache tomcat/7.0.43
- version/apache tomcat/7.0.44
- version/apache tomcat/7.0.45
- version/apache tomcat/7.0.46
- version/apache tomcat/7.0.47
- version/apache tomcat/7.0.48
- version/apache tomcat/7.0.49
- version/apache tomcat/7.0.50
- version/apache tomcat/7.0.51
- version/apache tomcat/7.0.54
- version/apache tomcat/7.0.55
- version/apache tomcat/7.0.56
- version/apache tomcat/7.0.57
- version/apache tomcat/7.0.58
- version/apache tomcat/7.0.59
- version/apache tomcat/7.0.60
- version/apache tomcat/7.0.61
- version/apache tomcat/7.0.62
- version/apache tomcat/7.0.63
- version/apache tomcat/7.0.64
- version/apache tomcat/7.0.65
- version/apache tomcat/7.0.66
- version/apache tomcat/7.0.67
- version/apache tomcat/7.0.68
- version/apache tomcat/7.0.69
- version/apache tomcat/7.0.70
- version/apache tomcat/7.0.71
- version/apache tomcat/7.0.72
- version/apache tomcat/7.0.73
- version/apache tomcat/7.0.74
- version/apache tomcat/7.0.75
- version/apache tomcat/7.0.76
- version/apache tomcat/7.0.77
- version/apache tomcat/7.0.78
- version/apache tomcat/7.0.79
- version/apache tomcat/7.0.80
- version/apache tomcat/7.0.81
- package-manager/maven