https://bugzilla.redhat.com/show_bug.cgi?id=1609613
Bug ID: 1609613 Summary: CVE-2018-1999002 jenkins: Flaw in the Stapler web framework allows remote unauthenticated users to read arbitrary files Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: sfowler@redhat.com CC: ahardin@redhat.com, aos-bugs@redhat.com, bleanhar@redhat.com, bparees@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jokerman@redhat.com, mchappel@redhat.com, mizdebsk@redhat.com, msrb@redhat.com Blocks: 1609611
An arbitrary file read vulnerability in the Stapler web framework used by Jenkins allowed unauthenticated users to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master process has access to.
External Reference:
https://jenkins.io/security/advisory/2018-07-18/#SECURITY-914
https://bugzilla.redhat.com/show_bug.cgi?id=1609613
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80718,reported=20180730,sou |80718,reported=20180730,sou |rce=oss-security,cvss3=7.5/ |rce=oss-security,cvss3=7.5/ |CVSS:3.0/AV:N/AC:L/PR:N/UI: |CVSS:3.0/AV:N/AC:L/PR:N/UI: |N/S:U/C:H/I:N/A:N,cwe=CWE-2 |N/S:U/C:H/I:N/A:N,cwe=CWE-2 |0,fedora-all/jenkins=affect |0,fedora-all/jenkins=affect |ed,openshift-enterprise-3/j |ed,openshift-enterprise-3/j |enkins=new |enkins=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1609613
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1610633
https://bugzilla.redhat.com/show_bug.cgi?id=1609613
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80718,reported=20180730,sou |80718,reported=20180730,sou |rce=oss-security,cvss3=7.5/ |rce=oss-security,cvss3=7.5/ |CVSS:3.0/AV:N/AC:L/PR:N/UI: |CVSS:3.0/AV:N/AC:L/PR:N/UI: |N/S:U/C:H/I:N/A:N,cwe=CWE-2 |N/S:U/C:H/I:N/A:N,cwe=CWE-2 |0,fedora-all/jenkins=affect |0,fedora-all/jenkins=affect |ed,openshift-enterprise-3/j |ed,openshift-enterprise-3/j |enkins=affected |enkins=notaffected
java-sig-commits@lists.fedoraproject.org