https://bugzilla.redhat.com/show_bug.cgi?id=1516788
Bug ID: 1516788
Summary: CVE-2017-1000391 jenkins: Unsafe use of user names as
directory names
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Jenkins stores metadata related to people, which encompasses actual user
accounts, as well as users appearing in SCM, in directories corresponding to
the user ID on disk. These directories used the user ID for their name without
additional escaping. This potentially resulted in a number of problems, such as
the following:
1. User names consisting of a single forward slash would have their user record
stored in the parent directory; deleting this user deleted all user records.
2. User names containing character sequences such as .. could be used to
clobber other configuration files in Jenkins.
This is not limited to the Jenkins user database security realm, other security
realms such as LDAP may allow users to create user names that result in
problems in Jenkins.
External References:
https://jenkins.io/security/advisory/2017-11-08/
--
You are receiving this mail because:
You are on the CC list for the bug.