Bug 958958 (CVE-2013-2034)

Summary: CVE-2013-2034 Jenkins: Multiple CSRF in MavenAbstractArtifactRecord.doRedeploy and Jenkins.doEval
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bleanhar, ccoleman, djorm, dmcphers, gmollett, jialiu, jrusnack, lmeyer, security-response-team, tkramer
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-02-13 00:50:22 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 958964, 988663    
Bug Blocks: 958963    

Description Kurt Seifried 2013-05-02 19:15:44 UTC 
Reported by Jesse Glick:

Multiple CSRF flaws exist in Jenkins, one allows remote users with the 
"ADMINISTER" privilege to run Jelly scripts which would allow arbitrary Java 
code execution.
Comment 2 Vincent Danen 2013-05-02 21:13:33 UTC 
This is now public

External References:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02
https://issues.jenkins-ci.org/browse/SECURITY-63
https://issues.jenkins-ci.org/browse/SECURITY-69
Comment 4 Garth Mollett 2013-08-29 22:25:21 UTC 
This issue has been addressed in following products:

  Red Hat OpenShift Enterprise 1.2

Via RHEA-2013:1032 https://rhn.redhat.com/errata/RHEA-2013-1032.html