[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <7201AC57-5316-478F-A241-C43FCC25B0F2@beckweb.net>
Date: Wed, 16 Jan 2019 17:51:47 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:
* Jenkins weekly 2.160
* Jenkins LTS 2.150.2
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2019-01-16/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-868
Users with the Overall/RunScripts permission (typically administrators)
were able to use the Jenkins script console to craft a 'Remember me'
cookie that would never expire.
This allowed attackers access to a Jenkins instance while the
corresponding user in the configured security realm exists, for example to
persist access after another successful attack.
SECURITY-901
When using an external security realm such as LDAP or Active Directory,
deleting a user from the security realm does not result in the user losing
access to Jenkins.
While deleting the user record from Jenkins did invalidate the 'Remember
me' cookie, there was no way to invalidate active sessions besides
restarting Jenkins or terminating sessions through other means, such as
Monitoring Plugin.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
