CVE-2019-10354
First published: Wed Jul 17 2019(Updated: )
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/jenkins weekly | <2.186 | 2.186 |
| redhat/Jenkins LTS | <2.176.2 | 2.176.2 |
| Jenkins Jenkins | <=2.176.1 | |
| Jenkins Jenkins | <=2.185 | |
| Redhat Openshift Container Platform | =3.11 | |
| Redhat Openshift Container Platform | =4.1 | |
| maven/org.kohsuke.stapler:stapler-parent | <1.257.1 | 1.257.1 |
| maven/org.jenkins-ci.main:jenkins-core | >=2.177<=2.185 | 2.186 |
| maven/org.jenkins-ci.main:jenkins-core | <=2.176.1 | 2.176.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2019-10354
- https://access.redhat.com/errata/RHSA-2019:2503
- https://access.redhat.com/errata/RHSA-2019:2548
- https://jenkins.io/security/advisory/2019-07-17/#SECURITY-534
- http://www.openwall.com/lists/oss-security/2019/07/17/2
- https://github.com/jenkinsci/jenkins/commit/279d8109eddb7a494428baf25af9756c2e33576b
- https://github.com/jenkinsci/stapler/commit/19637555a9f32d3875356b47234131d8b1e9fee4
- https://github.com/advisories/GHSA-6jfc-mc97-c7wg (Advisory)
- http://www.securityfocus.com/bid/109373
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1730876
- https://github.com/openshift/jenkins/blob/master/README.md#jenkins-security-advisories-the-master-image-from-this-repository-and-the-oc-binary
- https://access.redhat.com/security/cve/cve-2019-10354
- https://bugzilla.redhat.com/show_bug.cgi?id=1730869
- collector/nvd-index
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-6jfc-mc97-c7wg
- alias/CVE-2019-10354
- collector/github-advisory
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/severity
- agent/references
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/jenkins
- canonical/jenkins jenkins
- version/jenkins jenkins/2.176.1
- version/jenkins jenkins/2.185
- vendor/redhat
- canonical/redhat openshift container platform
- version/redhat openshift container platform/3.11
- version/redhat openshift container platform/4.1
- package-manager/maven
- package-manager/redhat