[Bug 1596122] New: CVE-2018-1000601 jenkins-plugin-ssh-credentials: Arbitrary file read vulnerability in SSH Credentials Plugin with Credentials Binding Plugin (SECURITY-440)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1596122
Bug ID: 1596122
Summary: CVE-2018-1000601 jenkins-plugin-ssh-credentials:
Arbitrary file read vulnerability in SSH Credentials
Plugin with Credentials Binding Plugin (SECURITY-440)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: ahardin(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, mchappel(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com
SSH Credentials Plugin allowed the creation of SSH credentials with keys "From
a file on Jenkins master". Credentials Binding Plugin 1.13 and newer allows
binding SSH credentials to environment variables. In combination, these two
features allow users with the permission to configure a job to read arbitrary
files on the Jenkins master by creating an SSH credential referencing an
arbitrary file on the Jenkins master, and binding it to an environment variable
in a job.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 9 months