Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 661512 (CVE-2018-1999001, CVE-2018-1999002, CVE-2018-1999003, CVE-2018-1999004, CVE-2018-1999005, CVE-2018-1999006, CVE-2018-1999007) - dev-util/jenkins-bin: Multiple vulnerabilities
Summary: dev-util/jenkins-bin: Multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2018-1999001, CVE-2018-1999002, CVE-2018-1999003, CVE-2018-1999004, CVE-2018-1999005, CVE-2018-1999006, CVE-2018-1999007
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://jenkins.io/security/advisory/...
Whiteboard: ~2 [noglsa]
Keywords:
: 662442 662628 (view as bug list)
Depends on:
Blocks:
 
Reported: 2018-07-18 15:14 UTC by Florian Schuhmacher
Modified: 2020-03-26 19:09 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Schuhmacher 2018-07-18 15:14:18 UTC 
SECURITY-897
Unauthenticated users could provide maliciously crafted login credentials 
that cause Jenkins to move the config.xml file from the Jenkins home 
directory. This configuration file contains basic configuration of 
Jenkins, including the selected security realm and authorization strategy. 
If Jenkins is started without this file present, it will revert to the 
legacy defaults of granting administrator access to anonymous users.


SECURITY-914
An arbitrary file read vulnerability in the Stapler web framework used by 
Jenkins allowed unauthenticated users to send crafted HTTP requests 
returning the contents of any file on the Jenkins master file system that 
the Jenkins master process has access to.


SECURITY-891
The URLs handling cancellation of queued builds did not perform a 
permission check, allowing users with Overall/Read permission to cancel 
queued builds.


SECURITY-892
The URL that initiates agent launches on the Jenkins master did not perform 
a permission check, allowing users with Overall/Read permission to initiate 
agent launches.


SECURITY-944
The build timeline widget shown on URLs like /view/…/builds did not 
properly escape display names of items. This resulted in a cross-site 
scripting vulnerability exploitable by users able to control item display 
names.


SECURITY-925
Files indicating when a plugin JPI file was last extracted into a 
subdirectory of plugins/ in the Jenkins home directory was accessible via 
HTTP by users with Overall/Read permission. This allowed unauthorized users 
to determine the likely install date of a given plugin.


SECURITY-390
Stapler is the web framework used by Jenkins to route HTTP requests. When 
its debug mode is enabled, HTTP 404 error pages display diagnostic 
information. Those error pages did not escape parts of URLs they displayed, 
in rare cases resulting in a cross-site scripting vulnerability.

Gentoo Security Scout
Florian Schuhmacher
Comment 1 Hans de Graaff gentoo-dev Security 2018-07-18 18:41:30 UTC 
jenkins-bin 2.121.2 (LTS) and jenkins-bin 2.133 have been added.
Comment 2 Hans de Graaff gentoo-dev Security 2018-07-18 18:47:50 UTC 
Vulnerable versions have been removed.
Comment 3 Hans de Graaff gentoo-dev Security 2018-08-03 06:25:29 UTC 
*** Bug 662628 has been marked as a duplicate of this bug. ***
Comment 4 Aaron Bauman (RETIRED) gentoo-dev 2018-11-24 23:56:32 UTC 
*** Bug 662442 has been marked as a duplicate of this bug. ***
Comment 5 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-26 19:09:26 UTC 
Tree is clean.