https://bugzilla.redhat.com/show_bug.cgi?id=1418716
Bug ID: 1418716
Summary: CVE-2017-2605 jenkins: Re-key admin monitor leaves
behind unencrypted credentials in upgraded
installations (SECURITY-376)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all
secrets in JENKINS_HOME with a new key. It also created a backup directory with
all old secrets, and the key used to encrypt them. These backups were
world-readable and not removed afterwards.
Jenkins now deletes the backup directory, if present. Upgrading from before
1.498 will no longer create a backup directory. Administrators relying on file
access permissions in their manually created backups are advised to check them
for the directory
$JENKINS_HOME/jenkins.security.RekeySecretAdminMonitor/backups, and delete it
if present.
All administrative monitors now require the user accessing them to be an
administrator.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/0be33cf7328fad6a7596ce9505a74...
--
You are receiving this mail because:
You are on the CC list for the bug.