https://bugzilla.redhat.com/show_bug.cgi?id=1609617
Bug ID: 1609617 Summary: CVE-2018-1999004 jenkins: Missing permission check allows users with Overall/Read permission to initiate agent launches Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: sfowler@redhat.com CC: ahardin@redhat.com, aos-bugs@redhat.com, bleanhar@redhat.com, bparees@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jokerman@redhat.com, mchappel@redhat.com, mizdebsk@redhat.com, msrb@redhat.com Blocks: 1609611
In Jenkins, the URL that initiates agent launches on the Jenkins master did not perform a permission check, allowing users with Overall/Read permission to initiate agent launches.
External Reference:
https://jenkins.io/security/advisory/2018-07-18/#SECURITY-892
https://bugzilla.redhat.com/show_bug.cgi?id=1609617
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1609619
--- Comment #1 from Sam Fowler sfowler@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1609619]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1609619 [Bug 1609619] CVE-2018-1999004 jenkins: Missing permission check allows users with Overall/Read permission to initiate agent launches [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1609617
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018 |0718,reported=20180730,sour |0718,reported=20180730,sour |ce=oss-security,cvss3=5.3/C |ce=oss-security,cvss3=5.3/C |VSS:3.0/AV:N/AC:L/PR:N/UI:N |VSS:3.0/AV:N/AC:L/PR:N/UI:N |/S:U/C:N/I:L/A:N,cwe=CWE-86 |/S:U/C:N/I:L/A:N,cwe=CWE-86 |2,fedora-all/jenkins=affect |2,fedora-all/jenkins=affect |ed,openshift-enterprise-3/j |ed,openshift-enterprise-3/j |enkins=new |enkins=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1609617
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1610642
java-sig-commits@lists.fedoraproject.org