[java-sig-commits] [Bug 1335416] New: CVE-2016-3722 jenkins: Malicious users with multiple user accounts can prevent other users from logging in (SECURITY-243)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1335416

Bug ID: 1335416
           Summary: CVE-2016-3722 jenkins: Malicious users with multiple
                    user accounts can prevent other users from logging in
                    (SECURITY-243)
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: low
          Priority: low
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]

The following flaw was found in Jenkins:

By changing the freely editable 'full name', malicious users with multiple user
accounts could prevent other users from logging in, as 'full name' was resolved
before actual user name to determine which account is currently trying to log
in.

External References:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-...