[java-sig-commits] [Bug 1609622] New: CVE-2018-1999006 jenkins: Users with Overall/ Read permission can view install date of plugins

https://bugzilla.redhat.com/show_bug.cgi?id=1609622

            Bug ID: 1609622
           Summary: CVE-2018-1999006 jenkins: Users with Overall/Read
                    permission can view install date of plugins
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team(a)redhat.com
          Reporter: sfowler(a)redhat.com
                CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
                    bleanhar(a)redhat.com, bparees(a)redhat.com,
                    ccoleman(a)redhat.com, dedgar(a)redhat.com,
                    java-sig-commits(a)lists.fedoraproject.org,
                    jgoulding(a)redhat.com, jokerman(a)redhat.com,
                    mchappel(a)redhat.com, mizdebsk(a)redhat.com,
                    msrb(a)redhat.com
            Blocks: 1609611



In Jenkins, files indicating when a plugin JPI file was last extracted into a
subdirectory of plugins/ in the Jenkins home directory was accessible via HTTP
by users with Overall/Read permission. This allowed unauthorized users to
determine the likely install date of a given plugin.


External Reference:

https://jenkins.io/security/advisory/2018-07-18/#SECURITY-925

-- 
You are receiving this mail because:
You are on the CC list for the bug.