https://bugzilla.redhat.com/show_bug.cgi?id=1620344
Bug ID: 1620344
Summary: CVE-2018-1999044 jenkins: Cron expression form
validation could enter infinite loop, potentially
resulting in denial of service
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1620339
Jenkins before LTS version 2.121.3 and weekly version 2.138 are vulnerable to a
denial of service.
The form validation for cron expressions (e.g. "Poll SCM", "Build
periodically") could enter infinite loops when cron expressions only matching
certain rare dates were entered, blocking request handling threads
indefinitely.
External Reference:
https://jenkins.io/security/advisory/2018-08-15/#SECURITY-790
--
You are receiving this mail because:
You are on the CC list for the bug.