Vulnerability Description
Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Jenkins | <= 1.585 |
| Apache | Tomcat | 7.0.41 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2015/01/22/3Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/72054Third Party AdvisoryVDB Entry
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1185148Issue TrackingThird Party AdvisoryVDB Entry
- https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc1PatchThird Party Advisory
- https://issues.jenkins-ci.org/browse/JENKINS-25019Issue TrackingVendor Advisory
- https://jenkins.io/changelog-old/Release NotesVendor Advisory
- http://www.openwall.com/lists/oss-security/2015/01/22/3Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/72054Third Party AdvisoryVDB Entry
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1185148Issue TrackingThird Party AdvisoryVDB Entry
- https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc1PatchThird Party Advisory
- https://issues.jenkins-ci.org/browse/JENKINS-25019Issue TrackingVendor Advisory
- https://jenkins.io/changelog-old/Release NotesVendor Advisory
FAQ
What is CVE-2014-9634?
CVE-2014-9634 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmissio...
How severe is CVE-2014-9634?
CVE-2014-9634 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-9634?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Jenkins, Apache Tomcat.