https://bugzilla.redhat.com/show_bug.cgi?id=1526596
Bug ID: 1526596 Summary: jenkins: CSRF protection delayed after startup Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: bleanhar@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jkeck@redhat.com, kseifried@redhat.com, mizdebsk@redhat.com, msrb@redhat.com
A race condition during Jenkins startup could result in the wrong order of execution of commands during initialization.
There’s a very short window of time after startup during which Jenkins may no longer show the "Please wait while Jenkins is getting ready to work" message, but Cross-Site Request Forgery (CSRF) protection may not yet be effective.
External references:
https://jenkins.io/security/advisory/2017-12-14/
https://bugzilla.redhat.com/show_bug.cgi?id=1526596
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1526597, 1526598
--- Comment #1 from Pedro Sampaio psampaio@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1526598] Affects: openshift-1 [bug 1526597]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1526598 [Bug 1526598] jenkins: CSRF protection delayed after startup [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1526596
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version|jenkins 2.95 |jenkins 2.95, jenkins | |2.89.2
https://bugzilla.redhat.com/show_bug.cgi?id=1526596
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1526600
https://bugzilla.redhat.com/show_bug.cgi?id=1526596
Mark Knowles mknowles@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |1215,reported=20171215,sour |1215,reported=20171215,sour |ce=internet,cvss3=7.5/CVSS: |ce=internet,cvss3=7.5/CVSS: |3.0/AV:N/AC:H/PR:L/UI:N/S:U |3.0/AV:N/AC:H/PR:L/UI:N/S:U |/C:H/I:H/A:H,cwe=CWE-362,op |/C:H/I:H/A:H,cwe=CWE-362,op |enshift-enterprise-3/jenkin |enshift-enterprise-3/jenkin |s=new,openshift-1/jenkins=a |s=defer,openshift-1/jenkins |ffected,fedora-all/jenkins= |=defer,fedora-all/jenkins=a |affected |ffected
https://bugzilla.redhat.com/show_bug.cgi?id=1526596
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ahardin@redhat.com, | |jokerman@redhat.com, | |mchappel@redhat.com Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |1215,reported=20171215,sour |1215,reported=20171215,sour |ce=internet,cvss3=7.5/CVSS: |ce=internet,cvss3=7.5/CVSS: |3.0/AV:N/AC:H/PR:L/UI:N/S:U |3.0/AV:N/AC:H/PR:L/UI:N/S:U |/C:H/I:H/A:H,cwe=CWE-362,op |/C:H/I:H/A:H,cwe=CWE-362,op |enshift-enterprise-3/jenkin |enshift-enterprise-3/jenkin |s=defer,openshift-1/jenkins |s=affected,openshift-1/jenk |=defer,fedora-all/jenkins=a |ins=defer,fedora-all/jenkin |ffected |s=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1526596
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1565308
java-sig-commits@lists.fedoraproject.org