Bug 1516788 – CVE-2017-1000391 jenkins: Unsafe use of user names as directory names

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1516788 - (CVE-2017-1000391) CVE-2017-1000391 jenkins: Unsafe use of user names as directory names

Summary:	CVE-2017-1000391 jenkins: Unsafe use of user names as directory names

Status:	CLOSED WONTFIX

Aliases:	CVE-2017-1000391

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20171109,reported=2...
Keywords:	Security

Depends On:	1516794 1516795
Blocks:	1516796
	Show dependency tree / graph

Reported:	2017-11-23 06:31 EST by Andrej Nemec
Modified:	2018-02-01 02:55 EST (History)
CC List:	10 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2018-02-01 02:55:46 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Andrej Nemec 2017-11-23 06:31:09 EST

Jenkins stores metadata related to people, which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping. This potentially resulted in a number of problems, such as the following:

1. User names consisting of a single forward slash would have their user record stored in the parent directory; deleting this user deleted all user records.

2. User names containing character sequences such as .. could be used to clobber other configuration files in Jenkins.

This is not limited to the Jenkins user database security realm, other security realms such as LDAP may allow users to create user names that result in problems in Jenkins.

External References:

https://jenkins.io/security/advisory/2017-11-08/

Comment 1 Andrej Nemec 2017-11-23 06:34:52 EST

Created jenkins tracking bugs for this issue:

Affects: fedora-all [bug 1516794]
Affects: openshift-1 [bug 1516795]

Note You need to log in before you can comment on or make changes to this bug.