Bug 1609609 (CVE-2018-1999001)

Summary: CVE-2018-1999001 jenkins: Remote unauthenticated users can move config.xml allowing administrator access to anonymous users
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: ahardin, aos-bugs, bleanhar, bparees, ccoleman, dedgar, java-sig-commits, jgoulding, jokerman, mchappel, mizdebsk, msrb
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: jenkins 2.133, jenkins 2.121.2 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:34:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1609610, 1610634    
Bug Blocks: 1609611    

Description Sam Fowler 2018-07-30 03:16:43 UTC 
Unauthenticated users could provide maliciously crafted login credentials that cause Jenkins to move the config.xml file from the Jenkins home directory. This configuration file contains basic configuration of Jenkins, including the selected security realm and authorization strategy. If Jenkins is started without this file present, it will revert to the legacy defaults of granting administrator access to anonymous users.

This issue was caused by the fix for SECURITY-499 in the 2017-11-08 security advisory


External Reference:

https://jenkins.io/security/advisory/2018-07-18/#SECURITY-897
Comment 1 Sam Fowler 2018-07-30 03:17:14 UTC 
Created jenkins tracking bugs for this issue:

Affects: fedora-all [bug 1609610]