https://bugzilla.redhat.com/show_bug.cgi?id=1609613
Bug ID: 1609613
Summary: CVE-2018-1999002 jenkins: Flaw in the Stapler web
framework allows remote unauthenticated users to read
arbitrary files
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1609611
An arbitrary file read vulnerability in the Stapler web framework used by
Jenkins allowed unauthenticated users to send crafted HTTP requests returning
the contents of any file on the Jenkins master file system that the Jenkins
master process has access to.
External Reference:
https://jenkins.io/security/advisory/2018-07-18/#SECURITY-914
--
You are receiving this mail because:
You are on the CC list for the bug.