REDHAT-BUG-1185151: Low severity jenkins lts vulnerability

Published Jan 23, 2015

Updated

Yann Rouillard reports:

Jenkins on Tomcat fails to set the httponly flag on cookies.

External references: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682 https://issues.jenkins-ci.org/browse/JENKINS-25019

Affected Software

2 affected components

Jenkins Jenkins

Apache Tomcat

Event History

Jan 23, 2015

Data Sourced

via Red Hat·05:23 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1185151?

The severity of REDHAT-BUG-1185151 is classified as a security vulnerability due to the failure to set the HttpOnly flag on cookies.

How do I fix REDHAT-BUG-1185151?

To fix REDHAT-BUG-1185151, ensure that the appropriate configuration for HttpOnly cookies is implemented in Jenkins running on Tomcat.

What does REDHAT-BUG-1185151 impact?

REDHAT-BUG-1185151 impacts Jenkins when deployed on Apache Tomcat, leading to potential exposure of session cookies.

Who reported REDHAT-BUG-1185151?

REDHAT-BUG-1185151 was reported by Yann Rouillard.

What is the main issue described in REDHAT-BUG-1185151?

The main issue described in REDHAT-BUG-1185151 is that Jenkins fails to set the HttpOnly flag on cookies, increasing the risk of client-side script access.