The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 1.638Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 1.625.2 | Nov 13, 2017 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade nodejs-strip-json-commentsUpgrade nodejs-preserveUpgrade nodejs-osenvUpgrade nodejs-repeat-elementUpgrade openvswitchUpgrade nodejs-lodash.createassignerUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-es6-promiseUpgrade nodejs-is-extendableUpgrade nodejs-ps-treeUpgrade nodejs-capture-stack-traceUpgrade nodejs-extglobUpgrade nodejs-is-extglobUpgrade nodejs-undefsafeUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-is-npmUpgrade nodejs-pause-streamUpgrade nodejs-glob-baseUpgrade nodejs-readdirpUpgrade nodejs-latest-versionUpgrade nodejs-lodash.keysUpgrade nodejs-fill-rangeUpgrade rhcUpgrade nodejs-for-inUpgrade nodejs-success-symbolUpgrade nodejs-filename-regexUpgrade nodejs-lodash.defaultsUpgrade nodejs-ansi-wrapUpgrade nodejs-timed-outUpgrade nodejs-touchUpgrade nodejs-lodash.restparamUpgrade openshift-ansibleUpgrade nodejs-arrifyUpgrade nodejs-lodash.baseassignUpgrade nodejs-semverUpgrade nodejs-lodash.basecopyUpgrade nodejs-is-redirectUpgrade nodejs-regex-cacheUpgrade atomic-openshiftUpgrade nodejs-url-parse-laxUpgrade openshift-origin-cartridge-cronUpgrade nodejs-async-eachUpgrade nodejs-array-uniqueUpgrade nodejs-configstoreUpgrade nodejs-is-equal-shallowUpgrade nodejs-error-exUpgrade nodejs-lodash.isarrayUpgrade nss_wrapperUpgrade nodejs-event-streamUpgrade nodejs-splitUpgrade nodejs-randomaticUpgrade nodejs-parse-globUpgrade nodejs-pinkieUpgrade nodejs-is-plain-objUpgrade nodejs-write-file-atomicUpgrade nodejs-chokidarUpgrade nodejs-nodemonUpgrade nodejs-string-lengthUpgrade origin-kibanaUpgrade nodejs-duplexerUpgrade nodejs-read-all-streamUpgrade nodejs-object-assignUpgrade nodejs-arr-diffUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-mkdirpUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-package-jsonUpgrade openshift-origin-msg-node-mcollectiveUpgrade nodejs-parse-jsonUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-uuidUpgrade nodejs-micromatchUpgrade nodejs-is-binary-pathUpgrade nodejs-create-error-classUpgrade nodejs-anymatchUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-rcUpgrade nodejs-expand-rangeUpgrade openshift-origin-cartridge-phpUpgrade nodejs-lodash.isargumentsUpgrade nodejs-for-ownUpgrade heapsterUpgrade nodejs-normalize-pathUpgrade nodejs-unzip-responseUpgrade nodejs-lodash.getnativeUpgrade nodejs-is-streamUpgrade nodejs-fromUpgrade nodejs-gotUpgrade nodejs-os-tmpdirUpgrade nodejs-map-streamUpgrade nodejs-slideUpgrade nodejs-lazy-cacheUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-lowercase-keysUpgrade nodejs-xdg-basedirUpgrade nodejs-isobjectUpgrade rubygem-openshift-origin-controllerUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-semver-diffUpgrade jenkinsUpgrade nodejs-iniUpgrade nodejs-bracesUpgrade nodejs-end-of-streamUpgrade nodejs-graceful-fsUpgrade openshift-origin-node-proxyUpgrade nodejs-throughUpgrade nodejs-is-numberUpgrade nodejs-arr-flattenUpgrade nodejs-update-notifierUpgrade nodejs-lodash.assignUpgrade nodejs-align-textUpgrade nodejs-kind-ofUpgrade openshift-origin-node-utilUpgrade nodejs-registry-urlUpgrade rubygem-openshift-origin-commonUpgrade nodejs-pinkie-promiseUpgrade nodejs-os-homedirUpgrade nodejs-is-primitiveUpgrade nodejs-object.omitUpgrade nodejs-duplexifyUpgrade phpUpgrade nodejs-binary-extensionsUpgrade openshift-origin-broker-utilUpgrade activemqUpgrade nodejs-prepend-httpUpgrade openshift-enterprise-upgradeUpgrade nodejs-node-status-codesUpgrade nodejs-glob-parentUpgrade nodejs-deep-extendUpgrade nodejs-expand-bracketsUpgrade nodejs-stream-combinerUpgrade nodejs-ansi-greenUpgrade nodejs-is-globUpgrade nodejs-optimistUpgrade nodejs-is-dotfile | Jun 18, 2018 | Nov 11, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub