[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <33ACD1E8-76A6-46A3-8CA9-10E78E9F5FC5@beckweb.net>
Date: Wed, 23 Jan 2019 11:17:46 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Re: Multiple vulnerabilities in Jenkins
> On 16. Jan 2019, at 17:51, Daniel Beck <ml@...kweb.net> wrote:
>
> SECURITY-868
> Users with the Overall/RunScripts permission (typically administrators)
> were able to use the Jenkins script console to craft a 'Remember me'
> cookie that would never expire.
>
> This allowed attackers access to a Jenkins instance while the
> corresponding user in the configured security realm exists, for example to
> persist access after another successful attack.
CVE-2019-1003003
> SECURITY-901
> When using an external security realm such as LDAP or Active Directory,
> deleting a user from the security realm does not result in the user losing
> access to Jenkins.
>
> While deleting the user record from Jenkins did invalidate the 'Remember
> me' cookie, there was no way to invalidate active sessions besides
> restarting Jenkins or terminating sessions through other means, such as
> Monitoring Plugin.
CVE-2019-1003004
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
