PT-2016-3806 · Cloudbees+1 · Jenkins

Alex Soto Bueno · Published 2016-02-03 · Updated 2022-05-13 · CVE-2015-7539

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.640 Jenkins LTS versions prior to 1.625.2

Description The issue concerns the Plugins Manager in Jenkins, which does not verify checksums for plugin files. This makes it easier for attackers to execute arbitrary code via a crafted plugin, particularly in man-in-the-middle attack scenarios.

Recommendations For Jenkins versions prior to 1.640, update to version 1.640 or later. For Jenkins LTS versions prior to 1.625.2, update to version 1.625.2 or later.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2015-7539

GHSA-X274-9M9R-FM5G

RHSA-2016:0070

RHSA-2016:0489

Affected Products

Jenkins

References · 11

• https://osv.dev/vulnerability/GHSA-x274-9m9r-fm5g · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2016:0070 · Vendor Advisory
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7539 · Security Note
• http://rhn.redhat.com/errata/RHSA-2016-0489.html · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/f99cb46e06f394637067730a82f46bddc3567295 · Note
• https://github.com/jenkinsci/jenkins/commit/c158648afa8888bc49ac337c973d4e4bc050118e · Note
• https://github.com/jenkinsci/jenkins/commit/11479a2cc0a322a6bcd7e65667f3d24aa4d444bb · Note
• https://github.com/jenkinsci/jenkins/commit/97adb71aa4509f91e408a16ba312e817ec015cf4 · Note
• https://github.com/jenkinsci/jenkins/commit/9ec88357a354d8354728cc06e2b8c8b68aee58bf · Note