CVE-2014-9634

Published: Sep 12, 2017

Modified: Aug 6, 2024

PUBLISHED

Description

Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

[oss-security] 20150122 Re: ping on CVE Request for jenkins-tomcat: Secure and HttpOnly flags are not, set for cookies with Jenkins on Tomcat

mailing-list

x_refsource_MLIST

https://bugzilla.redhat.com/show_bug.cgi?id=1185148

x_refsource_CONFIRM

https://jenkins.io/changelog-old/

x_refsource_CONFIRM

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769682

x_refsource_CONFIRM

https://issues.jenkins-ci.org/browse/JENKINS-25019

x_refsource_CONFIRM

https://github.com/jenkinsci/jenkins/commit/582128b9ac179a788d43c1478be8a5224dc19710

x_refsource_CONFIRM

72054

vdb-entry

x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2014-9634

Description

Affected Products

References