https://bugzilla.redhat.com/show_bug.cgi?id=1656865
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|urgent |high
Whiteboard|impact=critical,public=2018 |impact=important,public=201
|1205,reported=20181205,sour |81205,reported=20181205,sou
|ce=internet,cvss3=9.8/CVSS: |rce=internet,cvss3=8.8/CVSS
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |:3.0/AV:N/AC:L/PR:L/UI:N/S:
|/C:H/I:H/A:H,cwe=CWE-470,fe |U/C:H/I:H/A:H,cwe=CWE-470,f
|dora-all/jenkins=affected,o |edora-all/jenkins=affected,
|penshift-enterprise-3.1/jen |openshift-enterprise-3.1/je
|kins=affected,openshift-ent |nkins=affected,openshift-en
|erprise-3.4/jenkins=affecte |terprise-3.4/jenkins=affect
|d,openshift-enterprise-3.2/ |ed,openshift-enterprise-3.2
|jenkins=affected,openshift- |/jenkins=affected,openshift
|enterprise-3.3/jenkins=affe |-enterprise-3.3/jenkins=aff
|cted,openshift-enterprise-3 |ected,openshift-enterprise-
|.5/jenkins=affected,openshi |3.5/jenkins=affected,opensh
|ft-enterprise-3.6/jenkins=a |ift-enterprise-3.6/jenkins=
|ffected,openshift-enterpris |affected,openshift-enterpri
|e-3.7/jenkins=affected,open |se-3.7/jenkins=affected,ope
|shift-enterprise-3.10/jenki |nshift-enterprise-3.10/jenk
|ns=affected,openshift-enter |ins=affected,openshift-ente
|prise-3.9/jenkins=affected, |rprise-3.9/jenkins=affected
|openshift-enterprise-3.11/j |,openshift-enterprise-3.11/
|enkins=affected,openshift-o |jenkins=affected,openshift-
|nline-3/jenkins=defer |online-3/jenkins=defer
Severity|urgent |high
--- Comment #4 from Jason Shepherd <jshepherd(a)redhat.com> ---
From upstream advisory:
As of publication of this advisory, we are aware of the following potential
attacks in the latest Jenkins releases that do not yet contain this fix:
Unauthenticated users can invalidate all sessions
Users with Overall/Read permission could create new user objects in memory.
Users with Overall/Read access could manually kick off otherwise periodically
executed runs of implementations of AsyncPeriodicWork.
Given the vast potential attack surface, we fully expect other attacks, that we
are not currently aware of, to be possible on Jenkins releases that do not have
this fix applied. This is reflected in the high score we assigned to this
issue, rather than limiting the score to the impact through known issues.
--
You are receiving this mail because:
You are on the CC list for the bug.