https://bugzilla.redhat.com/show_bug.cgi?id=1620346
Bug ID: 1620346
Summary: CVE-2018-1999045 jenkins: "Remember me" cookie was
evaluated even if that feature is disabled
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1620339
Jenkins before LTS version 2.121.3 and weekly version 2.138 do not properly
disable "Remember me" cookies.
The "Remember me" feature can be disabled in the Jenkins security
configuration.
This did not disable the processing of previously set "Remember me" cookies, so
they still allowed users to be logged in.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-996
--
You are receiving this mail because:
You are on the CC list for the bug.