https://bugzilla.redhat.com/show_bug.cgi?id=1609624
Bug ID: 1609624
Summary: CVE-2018-1999007 jenkins: HTTP 404 error pages do not
escape URLs when Stapler framework used in debug mode,
allowing for XSS
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1609611
Stapler is the web framework used by Jenkins to route HTTP requests. When its
debug mode is enabled, HTTP 404 error pages display diagnostic information.
Those error pages did not escape parts of URLs they displayed, in rare cases
resulting in a cross-site scripting vulnerability.
External Reference:
https://jenkins.io/security/advisory/2018-07-18/#SECURITY-390
--
You are receiving this mail because:
You are on the CC list for the bug.