https://bugzilla.redhat.com/show_bug.cgi?id=1418731
Bug ID: 1418731 Summary: CVE-2017-2613 jenkins: User creation CSRF using GET by admins (SECURITY-406) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: anemec@redhat.com CC: abhgupta@redhat.com, bleanhar@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jkeck@redhat.com, joelsmith@redhat.com, kseifried@redhat.com, mizdebsk@redhat.com, msrb@redhat.com, tdawson@redhat.com, tiwillia@redhat.com
The following flaw was found in Jenkins:
When administrators accessed a URL like /user/example via HTTP GET, a user with the ID example was created if it did not exist. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records.
Accessing these URLs now no longer results in a user record getting created, Jenkins will respond with 404 Not Found if no such user exists. When using the internal Jenkins user database, new users can be created via Manage Jenkins » Manage Users. To restore the previous (unsafe) behavior, set the system property hudson.model.User.allowUserCreationViaUrl to true as described on Features controlled by system properties.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-...
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/b88b20ec473200db35d0a0d29dcf1920...
https://bugzilla.redhat.com/show_bug.cgi?id=1418731
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |jenkins 2.44, jenkins | |2.32.2
https://bugzilla.redhat.com/show_bug.cgi?id=1418731
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1418735 Depends On| |1418736
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1418736 [Bug 1418736] CVE-2017-2598 CVE-2017-2599 CVE-2017-2600 CVE-2017-2601 CVE-2017-2602 CVE-2017-2604 CVE-2017-2605 CVE-2017-2606 CVE-2017-2607 CVE-2017-2608 CVE-2017-2609 CVE-2017-2610 CVE-2017-2611 CVE-2017-2612 jenkins: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1418731
--- Comment #1 from Andrej Nemec anemec@redhat.com ---
Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1418736]
https://bugzilla.redhat.com/show_bug.cgi?id=1418731
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1395176
https://bugzilla.redhat.com/show_bug.cgi?id=1418731
Laura Pardo lpardo@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0201,reported=20170125,sour |0201,reported=20170125,sour |ce=distros,cvss3=5.4/CVSS:3 |ce=distros,cvss3=5.4/CVSS:3 |.0/AV:N/AC:L/PR:N/UI:R/S:U/ |.0/AV:N/AC:L/PR:N/UI:R/S:U/ |C:N/I:L/A:L,fedora-all/jenk |C:N/I:L/A:L,cwe=CWE-770,fed |ins=affected,openshift-ente |ora-all/jenkins=affected,op |rprise-3/jenkins=new,opensh |enshift-enterprise-3/jenkin |ift-enterprise-2/jenkins=ne |s=new,openshift-enterprise- |w |2/jenkins=new
java-sig-commits@lists.fedoraproject.org