Bug#767541: jenkins: CVE-2014-3665

2014-12-05 Thread Emmanuel Bourg
Control: severity -1 important jenkins/1.565.3-3 has been uploaded in unstable and unblocked for Jessie with a note about this issue in the README file and a warning in the user interface. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Tro

Bug#767541: jenkins: CVE-2014-3665

2014-11-22 Thread intrigeri
Hi Emmanuel, Emmanuel Bourg wrote (16 Nov 2014 12:06:07 GMT) : > The new LTS is probably too big to be pushed to testing now. As an > alternative I'm considering either disabling the master/slave mechanism, > or adding a big red warning in the UI to inform the user about the risks. Disabling the

Bug#767541: jenkins: CVE-2014-3665

2014-11-16 Thread Emmanuel Bourg
Hi Sylvain, Le 16/11/2014 11:26, b...@debian.org a écrit : > Hi from the Paris Bugs Squashing Party :) Thank you for helping! > In order to help people who participate, can you (jenkins' maintainer) > describe what you intend to do, and if help is possible? > > - The security ~fix is a new slav

Bug#767541: jenkins: CVE-2014-3665

2014-11-16 Thread beuc
Hi from the Paris Bugs Squashing Party :) In order to help people who participate, can you (jenkins' maintainer) describe what you intend to do, and if help is possible? >From what I understand: - The security ~fix is a new slave->master access control system - Jenkins releases a "LTS" version ev

Bug#767541: jenkins: CVE-2014-3665

2014-10-31 Thread Salvatore Bonaccorso
Source: jenkins Severity: important Tags: security upstream Hi, See [1] and [2] for details on CVE-2014-3665. [1] https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30 [2] https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control Regards, Salvat