https://bugzilla.redhat.com/show_bug.cgi?id=1545910
Bug ID: 1545910
Summary: jenkins: Improper input validation allows unintended
access to plugin resource files on case-insensitive
file systems
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
A flaw was found in Jenkins weekly up to and including 2.106 and Jenkins LTS up
to and including 2.89.3. Jenkins did not take into account case-insensitive
file systems when preventing access to plugin resource files that should not be
accessible. This allowed users with Overall/Read permission to download plugin
resource files in META-INF and WEB-INF directories, such as the plugins' JAR
files, which could contain hardcoded secrets.
References:
https://jenkins.io/security/advisory/2018-02-14/
--
You are receiving this mail because:
You are on the CC list for the bug.