https://bugzilla.redhat.com/show_bug.cgi?id=1730824
Bug ID: 1730824
Summary: CVE-2019-10352 jenkins: Arbitrary file write
vulnerability using file parameter definitions
(SECURITY-1424)
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190717,reported=20190717,sour
ce=internet,cvss3=6.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U
/C:N/I:H/A:N,cwe=CWE-22,openshift-enterprise-3.6/jenki
ns=new,openshift-enterprise-3.7/jenkins=new,openshift-
enterprise-3.9/jenkins=new,openshift-enterprise-3.10/j
enkins=new,openshift-enterprise-3.11/jenkins=new,opens
hift-enterprise-4.1/jenkins=new,fedora-all/jenkins=aff
ected
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: abenaiss(a)redhat.com, adam.kaplan(a)redhat.com,
ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, eparis(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com, vbobade(a)redhat.com, wzheng(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jenkins versions weekly before 2.186 and LTS
before 2.176.2. Users with Job/Configure permission could specify a relative
path escaping the base directory in the file name portion of a file parameter
definition. This path would be used to store the uploaded file on the Jenkins
master, resulting in an arbitrary file write vulnerability. This vulnerability
is the result of an incomplete fix for SECURITY-1074. File parameters that
escape the base directory are no longer accepted and the build will fail.
--
You are receiving this mail because:
You are on the CC list for the bug.