https://bugzilla.redhat.com/show_bug.cgi?id=1609609
Bug ID: 1609609
Summary: CVE-2018-1999001 jenkins: Remote unauthenticated users
can move config.xml allowing administrator access to
anonymous users
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Unauthenticated users could provide maliciously crafted login credentials that
cause Jenkins to move the config.xml file from the Jenkins home directory. This
configuration file contains basic configuration of Jenkins, including the
selected security realm and authorization strategy. If Jenkins is started
without this file present, it will revert to the legacy defaults of granting
administrator access to anonymous users.
This issue was caused by the fix for SECURITY-499 in the 2017-11-08 security
advisory
External Reference:
https://jenkins.io/security/advisory/2018-07-18/#SECURITY-897
--
You are receiving this mail because:
You are on the CC list for the bug.