https://bugzilla.redhat.com/show_bug.cgi?id=1642884
Bug ID: 1642884
Summary: jenkins: Ephemeral user record creation
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
eparis(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
By accessing a specific crafted URL on Jenkins instances using Jenkins' own
user database, users without Overall/Read access could create ephemeral user
records.
This behavior could be abused to create a large number of ephemeral user
records in memory.
External References:
https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1128
--
You are receiving this mail because:
You are on the CC list for the bug.