https://bugzilla.redhat.com/show_bug.cgi?id=1620354
Bug ID: 1620354
Summary: CVE-2018-1999047 jenkins: Unauthorized users could
cancel scheduled restarts initiated from the update
center
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1620339
Jenkins before LTS version 2.121.3 and weekly version 2.138 allow unauthorized
users to cancel scheduled restarts initiated from the update center.
Users with Overall/Read permission were able to access the URL used to cancel
scheduled restart jobs initiated via the update center ("Restart Jenkins when
installation is complete and no jobs are running") due to a lack of permission
checks.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-1076
--
You are receiving this mail because:
You are on the CC list for the bug.