Jenkins

Jenkins Security Releases - December 2018

jenkins-2018-12 Dec 1, 2018 Source: Vendor

Jenkins security advisories for December 2018: 4 CVEs, 5 credited researchers.

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

5 lines

Showing 1–5 of 5

CVE-2018-1000861 Known exploited (CISA KEV) BR2018-0000-041366 SECURITY-595 unclaimed

Code execution through crafted URLs

Credited as Daniel Beck, CloudBees, Inc., Jesse Glick, CloudBees, Inc.

CVE-2018-1000861 Known exploited (CISA KEV) BR2018-0000-041367 SECURITY-595 unclaimed

Code execution through crafted URLs

Credited as Wadeck Follonier, CloudBees, Inc.; and, independently, Apple Information Security; Evan Grant of Tenable; and Orange Tsai(@orange_8361) from DEVCORE

CVE-2018-1000862 BR2018-0000-041368 SECURITY-904 unclaimed

Workspace browser allowed accessing files outside the workspace

Credited as Apple Information Security

CVE-2018-1000863 BR2018-0000-041369 SECURITY-1072 unclaimed

Forced migration of user records

Credited as Nimrod Stoler of CyberArk Labs, and, independently, Evan Grant of Tenable

CVE-2018-1000864 BR2018-0000-041370 SECURITY-1193 unclaimed

Potential denial of service through cron expression form validation

Credited as Denis Shvedchenko, Sphere, Inc.