Jenkins
Jenkins Security Releases - August 2018
jenkins-2018-08 Aug 1, 2018 Source: Vendor
Jenkins security advisories for August 2018: 5 CVEs, 5 credited researchers.
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
5 lines
Showing 1–5 of 5 matching , clear filters
CVE-2018-1999042
BR2018-0000-041341
SECURITY-637
unclaimed
Jenkins allowed deserialization of URL objects with host components
Credited as Jesse Glick, CloudBees, Inc.
CVE-2018-1999043
BR2018-0000-041342
SECURITY-672
unclaimed
Ephemeral user record was created on some invalid authentication attempts
Credited as Wadeck Follonier, CloudBees, Inc., and, independently, Nimrod Stoler of CyberArk Labs
CVE-2018-1999044
BR2018-0000-041343
SECURITY-790
unclaimed
Cron expression form validation could enter infinite loop, potentially resulting in denial of service
Credited as Thomas de Grenier de Latour
CVE-2018-1999046
BR2018-0000-041344
SECURITY-1071
unclaimed
Unauthorized users could access agent logs
Credited as Orange Tsai(@orange_8361) from DEVCORE
CVE-2018-1999047
BR2018-0000-041345
SECURITY-1076
unclaimed
Unauthorized users could cancel scheduled restarts initiated from the update center
Credited as Wadeck Follonier, CloudBees, Inc.