Re: Security advisory in Jenkins

[Solar Designer <solar () openwall com>]

Bryan - I think Kohsuke is not subscribed.  I've added CC.

On Wed, Oct 01, 2014 at 08:36:59PM -0500, Bryan Drewery wrote:
> On 10/1/2014 6:25 PM, Kohsuke Kawaguchi wrote:
> > I just wanted to share that the Jenkins project issued a security advisory
> > today. These issues are independently found and we've aggregated into a
> > single release.
> >
> > The relevant CVE IDs, our bug tracking IDs are available here
> > <https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01>
> > .
> >
> > The new versions can be downloaded from here
> > <http://mirrors.jenkins-ci.org/>.
> >
> > (This is the first time I do this, so my apologies in advance for probably
> > failing to follow the expected format.)
>
> Kudos to all for finding and fixing these issues. It was quite a
> surprising list though. Were these fixes kept from release for an
> extended time? The timeframe for CVE-2013-2186 is especially concerning.

Many of these issues were brought to the distros list on Fri Sep 26
17:10:16 2014 UTC, and got their CVE IDs assigned there.  However,
CVE-2013-2186 was not among those.  I don't know why the old CVE ID,
nor how that issue was handled.

Alexander