Vulnerability Description
Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Jenkins | <= 1.585 |
| Apache | Tomcat | 7.0.41 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2015/01/22/3Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/72054Third Party AdvisoryVDB Entry
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1185151Issue TrackingThird Party AdvisoryVDB Entry
- https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc1PatchThird Party Advisory
- https://issues.jenkins-ci.org/browse/JENKINS-25019Issue TrackingVendor Advisory
- https://jenkins.io/changelog-old/Release NotesVendor Advisory
- http://www.openwall.com/lists/oss-security/2015/01/22/3Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/72054Third Party AdvisoryVDB Entry
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1185151Issue TrackingThird Party AdvisoryVDB Entry
- https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc1PatchThird Party Advisory
- https://issues.jenkins-ci.org/browse/JENKINS-25019Issue TrackingVendor Advisory
- https://jenkins.io/changelog-old/Release NotesVendor Advisory
FAQ
What is CVE-2014-9635?
CVE-2014-9635 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sens...
How severe is CVE-2014-9635?
CVE-2014-9635 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-9635?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Jenkins, Apache Tomcat.