https://bugzilla.redhat.com/show_bug.cgi?id=1609622
Bug ID: 1609622 Summary: CVE-2018-1999006 jenkins: Users with Overall/Read permission can view install date of plugins Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: sfowler@redhat.com CC: ahardin@redhat.com, aos-bugs@redhat.com, bleanhar@redhat.com, bparees@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jokerman@redhat.com, mchappel@redhat.com, mizdebsk@redhat.com, msrb@redhat.com Blocks: 1609611
In Jenkins, files indicating when a plugin JPI file was last extracted into a subdirectory of plugins/ in the Jenkins home directory was accessible via HTTP by users with Overall/Read permission. This allowed unauthorized users to determine the likely install date of a given plugin.
External Reference:
https://jenkins.io/security/advisory/2018-07-18/#SECURITY-925
https://bugzilla.redhat.com/show_bug.cgi?id=1609622
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1609623
--- Comment #1 from Sam Fowler sfowler@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1609623]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1609623 [Bug 1609623] CVE-2018-1999006 jenkins: Users with Overall/Read permission can view install date of plugins [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1609622
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018 |0718,reported=20180730,sour |0718,reported=20180730,sour |ce=oss-security,cvss3=4.3/C |ce=oss-security,cvss3=4.3/C |VSS:3.0/AV:N/AC:L/PR:L/UI:N |VSS:3.0/AV:N/AC:L/PR:L/UI:N |/S:U/C:L/I:N/A:N,cwe=CWE-28 |/S:U/C:L/I:N/A:N,cwe=CWE-28 |5,fedora-all/jenkins=affect |5,fedora-all/jenkins=affect |ed,openshift-enterprise-3/j |ed,openshift-enterprise-3/j |enkins=new |enkins=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1609622
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1610644
java-sig-commits@lists.fedoraproject.org