https://bugzilla.redhat.com/show_bug.cgi?id=1526596
Bug ID: 1526596 Summary: jenkins: CSRF protection delayed after startup Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: bleanhar@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jkeck@redhat.com, kseifried@redhat.com, mizdebsk@redhat.com, msrb@redhat.com
A race condition during Jenkins startup could result in the wrong order of execution of commands during initialization.
There’s a very short window of time after startup during which Jenkins may no longer show the "Please wait while Jenkins is getting ready to work" message, but Cross-Site Request Forgery (CSRF) protection may not yet be effective.
External references:
https://jenkins.io/security/advisory/2017-12-14/