CVE-2014-9635: Medium severity Jenkins Jenkins vulnerability
Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.
Other sources
Yann Rouillard reports:
Jenkins on Tomcat fails to set the httponly flag on cookies.
External references: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682 https://issues.jenkins-ci.org/browse/JENKINS-25019
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9635?
CVE-2014-9635 has a medium severity level due to its potential to expose sensitive information through script access to cookies.
How do I fix CVE-2014-9635?
To fix CVE-2014-9635, update Jenkins to version 1.586 or later.
What versions of Jenkins are affected by CVE-2014-9635?
CVE-2014-9635 affects Jenkins versions prior to 1.586.
Is CVE-2014-9635 specific to certain versions of Tomcat?
CVE-2014-9635 is specific to Jenkins running on Tomcat version 7.0.41 or later.
What kind of attack does CVE-2014-9635 facilitate?
CVE-2014-9635 facilitates attacks that allow remote attackers to access sensitive information via script access to session cookies.