java-sig-commits July 2018

java-sig-commits@lists.fedoraproject.org

1 participants
421 discussions

[Bug 1596122] New: CVE-2018-1000601 jenkins-plugin-ssh-credentials: Arbitrary file read vulnerability in SSH Credentials Plugin with Credentials Binding Plugin (SECURITY-440)
by bugzilla＠redhat.com 02 Jul '18

02 Jul '18

https://bugzilla.redhat.com/show_bug.cgi?id=1596122 Bug ID: 1596122 Summary: CVE-2018-1000601 jenkins-plugin-ssh-credentials: Arbitrary file read vulnerability in SSH Credentials Plugin with Credentials Binding Plugin (SECURITY-440) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: ahardin(a)redhat.com, bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, mchappel(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com SSH Credentials Plugin allowed the creation of SSH credentials with keys "From a file on Jenkins master". Credentials Binding Plugin 1.13 and newer allows binding SSH credentials to environment variables. In combination, these two features allow users with the permission to configure a job to read arbitrary files on the Jenkins master by creating an SSH credential referencing an arbitrary file on the Jenkins master, and binding it to an environment variable in a job. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits July 2018