GHSA-g7cf-wg27-qw87
Jenkins secure flag not set on session cookies
At a glance
- Published
- Updated
- CVE
- CVE-2014-9634
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.jenkins-ci.main:jenkins-core | introduced 0, fixed 1.586 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-9634 ADVISORY
- https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710 WEB
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1185148 WEB
- https://issues.jenkins-ci.org/browse/JENKINS-25019 WEB
- https://jenkins.io/changelog-old WEB
- http://www.openwall.com/lists/oss-security/2015/01/22/3 WEB
- http://www.securityfocus.com/bid/72054 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |