Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins LTS to version 1.625.2Upgrade Jenkins to version 1.638Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest version | Nov 13, 2017 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade nodejs-lodash.keysUpgrade jenkinsUpgrade rhcUpgrade nodejs-package-jsonUpgrade nodejs-bracesUpgrade nodejs-error-exUpgrade nodejs-update-notifierUpgrade nodejs-uuidUpgrade nodejs-nodemonUpgrade nodejs-binary-extensionsUpgrade nodejs-fill-rangeUpgrade nodejs-string-lengthUpgrade nodejs-glob-baseUpgrade nodejs-isobjectUpgrade nodejs-os-homedirUpgrade nodejs-lodash.createassignerUpgrade openshift-origin-cartridge-pythonUpgrade openshift-origin-node-utilUpgrade openshift-origin-msg-node-mcollectiveUpgrade nodejs-parse-jsonUpgrade openshift-ansibleUpgrade nodejs-registry-urlUpgrade nodejs-lazy-cacheUpgrade nodejs-is-extglobUpgrade nodejs-lodash.restparamUpgrade nodejs-ansi-wrapUpgrade nodejs-capture-stack-traceUpgrade nodejs-timed-outUpgrade nodejs-pinkie-promiseUpgrade atomic-openshiftUpgrade heapsterUpgrade nodejs-deep-extendUpgrade nodejs-unzip-responseUpgrade nodejs-xdg-basedirUpgrade nodejs-align-textUpgrade nodejs-os-tmpdirUpgrade nodejs-slideUpgrade nodejs-for-ownUpgrade nodejs-is-binary-pathUpgrade nodejs-parse-globUpgrade nodejs-is-numberUpgrade openshift-origin-node-proxyUpgrade openshift-enterprise-upgradeUpgrade nodejs-fromUpgrade nodejs-touchUpgrade nodejs-lodash.isarrayUpgrade nodejs-splitUpgrade nodejs-end-of-streamUpgrade openshift-origin-broker-utilUpgrade nodejs-prepend-httpUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-object-assignUpgrade nodejs-is-plain-objUpgrade nodejs-lodash.basecopyUpgrade nodejs-is-dotfileUpgrade nodejs-array-uniqueUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-ps-treeUpgrade nodejs-node-status-codesUpgrade nodejs-is-globUpgrade nodejs-is-npmUpgrade rubygem-openshift-origin-commonUpgrade nodejs-semver-diffUpgrade nodejs-normalize-pathUpgrade openshift-origin-cartridge-phpUpgrade nss_wrapperUpgrade nodejs-iniUpgrade nodejs-is-extendableUpgrade nodejs-micromatchUpgrade nodejs-filename-regexUpgrade nodejs-duplexifyUpgrade nodejs-for-inUpgrade nodejs-expand-bracketsUpgrade nodejs-arrifyUpgrade nodejs-graceful-fsUpgrade nodejs-read-all-streamUpgrade nodejs-randomaticUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade openshift-origin-cartridge-cronUpgrade nodejs-async-eachUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-throughUpgrade nodejs-success-symbolUpgrade nodejs-gotUpgrade nodejs-glob-parentUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-expand-rangeUpgrade activemqUpgrade nodejs-stream-combinerUpgrade nodejs-arr-flattenUpgrade openvswitchUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-mkdirpUpgrade nodejs-lodash.assignUpgrade nodejs-strip-json-commentsUpgrade nodejs-url-parse-laxUpgrade nodejs-lodash.isargumentsUpgrade nodejs-lodash.baseassignUpgrade nodejs-is-redirectUpgrade nodejs-map-streamUpgrade nodejs-repeat-elementUpgrade nodejs-lowercase-keysUpgrade nodejs-lodash.getnativeUpgrade nodejs-write-file-atomicUpgrade nodejs-es6-promiseUpgrade nodejs-kind-ofUpgrade phpUpgrade nodejs-semverUpgrade nodejs-event-streamUpgrade nodejs-is-streamUpgrade nodejs-duplexerUpgrade nodejs-arr-diffUpgrade nodejs-extglobUpgrade nodejs-rcUpgrade nodejs-regex-cacheUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-is-primitiveUpgrade nodejs-readdirpUpgrade nodejs-preserveUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-latest-versionUpgrade nodejs-optimistUpgrade nodejs-ansi-greenUpgrade nodejs-osenvUpgrade nodejs-chokidarUpgrade nodejs-undefsafeUpgrade nodejs-pause-streamUpgrade nodejs-configstoreUpgrade nodejs-is-equal-shallowUpgrade nodejs-create-error-classUpgrade nodejs-object.omitUpgrade nodejs-lodash.defaultsUpgrade nodejs-pinkieUpgrade nodejs-anymatchUpgrade origin-kibana | Jun 18, 2018 | Nov 11, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub