hitoshura25/cvefixes huggingface dataset:
CVE-2013-0158 (Java, published 2013-02-24T22:55Z)
Description: value: Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.
Severity: LOW (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
core/src/main/java/jenkins/model/Jenkins.java
core/src/main/java/jenkins/security/RekeySecretAdminMonitor.java
Commit message: [SECURITY-49] mark secret.key generated by post SECURITY-49 Jenkins.

If JENKINS_HOME is created by a post SECURIT-49 Jenkins (LTS, and other
variants), then there's no need to alarm the user.


Vulnerable code:
        if (Jenkins.getInstance().isUpgradedFromBefore(new VersionNumber("1.496.*")))

Fixed code:
import jenkins.util.io.FileBoolean;

                // this marker indicates that the secret.key is generated by the version of Jenkins post SECURITY-49.
                // this indicates that there's no need to rewrite secrets on disk
                new FileBoolean(new File(root,"secret.key.not-so-secret")).on();
        Jenkins j = Jenkins.getInstance();
        if (j.isUpgradedFromBefore(new VersionNumber("1.496.*"))
        &&  new FileBoolean(new File(j.getRootDir(),"secret.key.not-so-secret")).isOff())
CVE-2013-0158 (Java, published 2013-02-24T22:55Z)
Description: value: Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.
Severity: LOW (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
core/src/main/java/jenkins/security/ConfidentialStore.java
core/src/main/java/jenkins/security/DefaultConfidentialStore.java
Commit message: [SECURITY-49] Backing off from @Extension-based discovery.

This is because we discovered some plugins that use Secret early on in
the initialization.


Vulnerable code:
 * by writing a subclass, mark it with {@link Extension} annotation, package it as a Jenkins module,
 * and bundling it with the war file.
        return Jenkins.getInstance().getExtensionList(ConfidentialStore.class).get(0);
import hudson.Extension;
@Extension(ordinal=-99999) // small ordinal value to allow other higher ones to take over

Fixed code:
import hudson.Lookup;
import hudson.init.InitMilestone;
import hudson.util.Secret;
import hudson.util.Service;
import org.kohsuke.MetaInfServices;
import java.util.List;
import java.util.logging.Level;
import java.util.logging.Logger;
 * by writing a subclass, mark it with {@link MetaInfServices} annotation, package it as a Jenkins module,
 * and bundling it with the war file. This doesn't use {@link Extension} because some plugins
 * have been found to use {@link Secret} before we get to {@link InitMilestone#PLUGINS_PREPARED}, and
 * therefore {@link Extension}s aren't loaded yet. (Similarly, it's conceivable that some future
 * core code might need this early on during the boot sequence.)

        Lookup lookup = Jenkins.getInstance().lookup;
        ConfidentialStore cs = lookup.get(ConfidentialStore.class);
        if (cs==null) {
            try {
                List<ConfidentialStore> r = (List) Service.loadInstances(ConfidentialStore.class.getClassLoader(), ConfidentialStore.class);
                if (!r.isEmpty())
                    cs = r.get(0);
            } catch (IOException e) {
                LOGGER.log(Level.WARNING, "Failed to list up ConfidentialStore implementations",e);
                // fall through
            }

            if (cs==null)
                try {
                    cs = new DefaultConfidentialStore();
                } catch (Exception e) {
                    // if it's still null, bail out
                    throw new Error(e);
                }

            cs = lookup.setIfNull(ConfidentialStore.class,cs);
        }
        return cs;

    private static final Logger LOGGER = Logger.getLogger(ConfidentialStore.class.getName());
// @MetaInfServices --- not annotated because this is the fallback implementation
CVE-2013-7330 (Java, published 2014-10-17T15:55Z)
Description: value: Jenkins before 1.502 allows remote authenticated users to configure an otherwise restricted project via vectors related to post-build actions.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
core/src/main/java/hudson/model/AbstractProject.java
core/src/main/java/hudson/model/Descriptor.java
core/src/main/java/hudson/tasks/BuildTrigger.java
core/src/main/resources/hudson/tasks/Messages.properties
core/src/main/resources/lib/hudson/project/config-upstream-pseudo-trigger.jelly
Commit message: [SECURITY-55]

This patch makes standard post-build action refuse to let you configure a downstream project you cannot currently build.
The one from parameterized-trigger will show an error in the configure screen but still lets you save the configuration; needs an analogous patch to that plugin.
Does not yet protect against POSTing config.xml with the trigger.
(cherry picked from commit 757bc8a53956e6fbab267214e6e0896f03c3c262)

Conflicts:

	core/src/main/java/hudson/model/Descriptor.java


Vulnerable code:
                items.add(find(descriptors,kind).newInstance(req,jo));
    public static <T extends Descriptor> T find(Collection<? extends T> list, String className) {
    public static Descriptor find(String className) {
        public FormValidation doCheck(@AncestorInPath Item project, @QueryParameter String value ) {
        checkUrl="'descriptorByName/hudson.tasks.BuildTrigger/check?value='+encodeURIComponent(this.value)"

Fixed code:

        for (Publisher _t : Descriptor.newInstancesFromHeteroList(req, json, "publisher", Jenkins.getInstance().getExtensionList(BuildTrigger.DescriptorImpl.class))) {
            BuildTrigger t = (BuildTrigger) _t;
            for (AbstractProject downstream : t.getChildProjects(this)) {
                downstream.checkPermission(BUILD);
            }
        }
                Descriptor<T> d = find(descriptors, kind);
                if (d != null) {
                    items.add(d.newInstance(req, jo));
                }
    public static @CheckForNull <T extends Descriptor> T find(Collection<? extends T> list, String className) {
    public static @CheckForNull Descriptor find(String className) {
        public FormValidation doCheck(@AncestorInPath Item project, @QueryParameter String value, @QueryParameter boolean upstream) {
                    if (!upstream && !item.hasPermission(Item.BUILD)) {
                        return FormValidation.error(Messages.BuildTrigger_you_have_no_permission_to_build_(projectName));
                    }
BuildTrigger.you_have_no_permission_to_build_=You have no permission to build {0}
        checkUrl="'descriptorByName/hudson.tasks.BuildTrigger/check?upstream=true&amp;value='+encodeURIComponent(this.value)"
CVE-2014-2059 (Java, published 2014-03-01T00:01Z)
Description: value: Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
core/src/main/java/hudson/cli/CreateJobCommand.java
Commit message: [FIXED SECURITY-108] Check job name created via CLI


Vulnerable code:

Fixed code:
        Jenkins.checkGoodName(name);
CVE-2014-2062 (Java, published 2014-10-17T15:55Z)
Description: value: Jenkins before 1.551 and LTS before 1.532.2 does not invalidate the API token when a user is deleted, which allows remote authenticated users to retain access via the token.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
core/src/main/java/jenkins/security/ApiTokenFilter.java
Commit message: [FIXED SECURITY-89] When checking an API token, verify that the user actually exists.


Vulnerable code:

Fixed code:
import hudson.security.UserMayOrMayNotExistException;
import jenkins.model.Jenkins;
import org.acegisecurity.userdetails.UsernameNotFoundException;
import org.springframework.dao.DataAccessException;
                try {
                    Jenkins.getInstance().getSecurityRealm().loadUserByUsername(username);
                } catch (UserMayOrMayNotExistException x) {
                    // OK, give them the benefit of the doubt.
                } catch (UsernameNotFoundException x) {
                    // Not/no longer a user; deny the API token. (But do not leak the information that this happened.)
                    chain.doFilter(request, response);
                    return;
                } catch (DataAccessException x) {
                    throw new ServletException(x);
                }
CVE-2014-2063 (Other, published 2014-10-17T15:55Z)
Description: value: Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Severity: HIGH (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
core/src/main/resources/lib/layout/layout.jelly
Commit message: [FIXED SECURITY-80] Add X-Frame-Options head to prevent clickjacking attacks


Vulnerable code:

Fixed code:
<st:header name="X-Frame-Options" value="sameorigin" />
CVE-2014-2064 (Java, published 2014-10-17T15:55Z)
Description: value: The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
Commit message: [FIXED SECURITY-79] Prevent (private security realm) usernames from being guessed.


Vulnerable code:
        if (!u.isPasswordCorrect(password))
            throw new BadCredentialsException("Failed to login as "+username);

Fixed code:
import java.util.MissingResourceException;
import java.util.ResourceBundle;
        if (!u.isPasswordCorrect(password)) {
            String message;
            try {
                message = ResourceBundle.getBundle("org.acegisecurity.messages").getString("AbstractUserDetailsAuthenticationProvider.badCredentials");
            } catch (MissingResourceException x) {
                message = "Bad credentials";
            }
            throw new BadCredentialsException(message);
        }
CVE-2014-2065 (Java, published 2014-10-17T15:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
core/src/main/java/hudson/Functions.java
core/src/main/java/hudson/model/View.java
core/src/main/java/jenkins/model/Jenkins.java
core/src/main/resources/lib/hudson/setIconSize.jelly
Commit message: [FIXED SECURITY-77] XSS in iconSize cookie.


Vulnerable code:
            iconSize = req != null ? Functions.getCookie(req, "iconSize", "32x32") : "32x32";
import java.util.regex.Pattern;
        if(qs==null || !ICON_SIZE.matcher(qs).matches())
        Cookie cookie = new Cookie("iconSize", qs);
    private static final Pattern ICON_SIZE = Pattern.compile("\\d+x\\d+");

  <j:set scope="parent" var="iconSize" value="${h.getCookie(request,'iconSize','32x32')}" />

Fixed code:
import org.kohsuke.accmod.Restricted;
import org.kohsuke.accmod.restrictions.NoExternalUse;
    private static final Pattern ICON_SIZE = Pattern.compile("\\d+x\\d+");
    @Restricted(NoExternalUse.class)
    public static String validateIconSize(String iconSize) throws SecurityException {
        if (!ICON_SIZE.matcher(iconSize).matches()) {
            throw new SecurityException("invalid iconSize");
        }
        return iconSize;
    }

            iconSize = req != null ? Functions.validateIconSize(Functions.getCookie(req, "iconSize", "32x32")) : "32x32";
        if(qs==null)
        Cookie cookie = new Cookie("iconSize", Functions.validateIconSize(qs));
  <j:set scope="parent" var="iconSize" value="${h.validateIconSize(h.getCookie(request,'iconSize','32x32'))}" />
CVE-2014-2066 (Java, published 2014-10-17T15:55Z)
Description: value: Session fixation vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to hijack web sessions via vectors involving the "override" of Jenkins cookies.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java
Commit message: [FIXED SECURITY-75] Invalidate session after login to avoid session fixation


Vulnerable code:

Fixed code:
        request.getSession().invalidate();
CVE-2014-2067 (Java, published 2014-03-01T00:01Z)
Description: value: Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
core/src/main/java/hudson/model/Cause.java
Commit message: [FIXED SECURITY-74] Apply markup formatter to remote cause note.


Vulnerable code:
                return Messages.Cause_RemoteCause_ShortDescriptionWithNote(addr, note);
            } else {
                return Messages.Cause_RemoteCause_ShortDescription(addr);

Fixed code:
import java.io.IOException;
                try {
                    return Messages.Cause_RemoteCause_ShortDescriptionWithNote(addr, Jenkins.getInstance().getMarkupFormatter().translate(note));
                } catch (IOException x) {
                    // ignore
                }
            return Messages.Cause_RemoteCause_ShortDescription(addr);
CVE-2014-2068 (Java, published 2014-10-17T15:55Z)
Description: value: The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
core/src/main/java/hudson/util/RemotingDiagnostics.java
Commit message: [FIXED SECURITY-73] Require RUN_SCRIPTS for /heapDump.


Vulnerable code:
            owner.checkPermission(Jenkins.ADMINISTER);

Fixed code:
            owner.checkPermission(Jenkins.RUN_SCRIPTS);
CVE-2017-2599 (Unknown, published 2018-04-11T16:29Z)
Description: value: Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
Commit message: Merge pull request #90 from jenkinsci-cert/SECURITY-321

[SECURITY-321] Prevent existing items from being overwritten even if you cannot DISCOVER them

Vulnerable code:

Fixed code:
CVE-2017-2600 (Unknown, published 2018-05-15T20:29Z)
Description: value: In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
Commit message: Merge pull request #82 from jenkinsci-cert/security-343

[SECURITY-343] Restrict API access to NodeMonitor data

Vulnerable code:

Fixed code:
CVE-2017-2601 (Unknown, published 2018-05-10T13:29Z)
Description: value: Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
Commit message: Merge pull request #95 from jenkinsci-cert/SECURITY-353

[SECURITY-353] Persisted XSS in parameter definition names and value descriptions

Vulnerable code:

Fixed code:
CVE-2017-2602 (Unknown, published 2018-05-15T21:29Z)
Description: value: jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358).
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
Commit message: Merge pull request #89 from jenkinsci-cert/SECURITY-358

[SECURITY-358] Restrict access to metadata used by WorkflowRun

Vulnerable code:

Fixed code:
CVE-2017-2604 (Unknown, published 2018-05-15T21:29Z)
Description: value: In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks (SECURITY-371).
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
Commit message: Merge pull request #85 from jenkinsci-cert/security-371-staplerproxy

[SECURITY-371] Secure all administrative monitors

Vulnerable code:

Fixed code:
CVE-2017-2606 (Unknown, published 2018-05-08T20:29Z)
Description: value: Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible (SECURITY-380). This only affects anonymous users (other users legitimately have access) that were able to get a list of items via an UnprotectedRootAction.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
Commit message: Merge pull request #86 from jenkinsci-cert/SECURITY-380

[FIX SECURITY-380] Don't optimize permission check in getItems()

Vulnerable code:

Fixed code:
CVE-2017-2609 (Unknown, published 2018-05-22T17:29Z)
Description: value: jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on the search box discloses the names of the views in its suggestions, including the ones for which the current user does not have access to.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
Commit message: Merge pull request #96 from jenkinsci-cert/SECURITY-385

[SECURITY-385] Only suggest visible views in search

Vulnerable code:

Fixed code:
CVE-2017-2610 (Unknown, published 2018-05-15T21:29Z)
Description: value: jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names (SECURITY-388).
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
Commit message: Merge pull request #98 from jenkinsci-cert/SECURITY-388

[SECURITY-388] Escape metacharacters in the search box

Vulnerable code:

Fixed code: