https://bugzilla.redhat.com/show_bug.cgi?id=1501812
Bug ID: 1501812
Summary: jenkins: Arbitrary shell command execution on master
by users with Agent-related permissions (SECURITY-478)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Users with permission to create or configure agents in Jenkins could configure
a launch method called Launch agent via execution of command on master. This
allowed them to run arbitrary shell commands on the master node whenever the
agent was supposed to be launched.
External References:
https://jenkins.io/security/advisory/2017-10-11/
--
You are receiving this mail because:
You are on the CC list for the bug.