Bug ID: 1699701
Summary: CVE-2019-1003049 jenkins: Jenkins accepted cached
legacy CLI authentication
Product: Security Response
CC: adam.kaplan(a)redhat.com, ahardin(a)redhat.com,
Target Milestone: ---
The fix for SECURITY-901/CVE-2019-1003004 in Jenkins 2.150.2 and 2.160 did not
reject existing remoting-based CLI authentication caches.
This means that users who cached their CLI authentication before Jenkins was
updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated.
Support for the remoting-based CLI was dropped in Jenkins 2.165, so newer
weekly releases are not affected. Jenkins 2.164.2 no longer supports legacy CLI
authentication caches from before 2.150.2/2.160, and these users will be
considered logged out.
You are receiving this mail because:
You are on the CC list for the bug.