https://bugzilla.redhat.com/show_bug.cgi?id=1620337
Bug ID: 1620337
Summary: CVE-2018-1999042 jenkins: Deserialization of URL
objects with host components
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Jenkins before LTS version 2.121.3 and weekly version 2.138 allow
deserialization of URL objects via Remoting (agent communication) and XStream.
This could in rare cases be used by attackers to have Jenkins look up specified
hosts' DNS records.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-637
--
You are receiving this mail because:
You are on the CC list for the bug.