GHSA-66cr-6whx-732p
Jenkins improperly ensures trust separation
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2014-3665
Description
Jenkins prior to 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.jenkins-ci.main:jenkins-core | introduced 0, fixed 1.587 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2014-3665 ADVISORY
- https://access.redhat.com/errata/RHBA-2014:1630 WEB
- https://access.redhat.com/security/cve/CVE-2014-3665 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1147767 WEB
- https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control WEB
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |