CVE-2019-10354
First published: Wed Jul 17 2019(Updated: )
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.kohsuke.stapler:stapler-parent | <1.257.1 | 1.257.1 |
| maven/org.jenkins-ci.main:jenkins-core | >=2.177<=2.185 | 2.186 |
| maven/org.jenkins-ci.main:jenkins-core | <=2.176.1 | 2.176.2 |
| redhat/jenkins weekly | <2.186 | 2.186 |
| redhat/Jenkins LTS | <2.176.2 | 2.176.2 |
| Jenkins Jenkins | <=2.176.1 | |
| Jenkins Jenkins | <=2.185 | |
| Red Hat OpenShift Container Platform | =3.11 | |
| Red Hat OpenShift Container Platform | =4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2019-10354
- https://access.redhat.com/errata/RHSA-2019:2503
- https://access.redhat.com/errata/RHSA-2019:2548
- https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534
- http://www.openwall.com/lists/oss-security/2019/07/17/2
- https://github.com/jenkinsci/jenkins/commit/279d8109eddb7a494428baf25af9756c2e33576b
- https://github.com/jenkinsci/stapler/commit/19637555a9f32d3875356b47234131d8b1e9fee4
- https://github.com/advisories/GHSA-6jfc-mc97-c7wg (Advisory)
- http://www.securityfocus.com/bid/109373
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1730876
- https://github.com/openshift/jenkins/blob/master/README.md#jenkins-security-advisories-the-master-image-from-this-repository-and-the-oc-binary
- https://access.redhat.com/security/cve/cve-2019-10354
- https://bugzilla.redhat.com/show_bug.cgi?id=1730869
- collector/github-advisory-latest
- alias/GHSA-6jfc-mc97-c7wg
- alias/CVE-2019-10354
- collector/github-advisory
- agent/weakness
- agent/type
- agent/severity
- agent/references
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-cve
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- agent/source
- package-manager/maven
- package-manager/redhat
- vendor/jenkins
- canonical/jenkins jenkins
- version/jenkins jenkins/2.176.1
- version/jenkins jenkins/2.185
- vendor/redhat
- canonical/red hat openshift container platform
- version/red hat openshift container platform/3.11
- version/red hat openshift container platform/4.1