Bug 1537187 (CVE-2018-1000015) - CVE-2018-1000015 jenkins-plugin-workflow-durable-task-step: Incorrect permission checks in Pipeline: Nodes and Processes plugin allows executing builds on agents while lacking Computer/Build permission (SECURITY-675)
Summary: CVE-2018-1000015 jenkins-plugin-workflow-durable-task-step: Incorrect permiss...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2018-1000015
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1537192
TreeView+ depends on / blocked
 
Reported: 2018-01-22 16:13 UTC by Adam Mariš
Modified: 2021-02-17 00:56 UTC (History)
7 users (show)

Fixed In Version: jenkins-plugin-workflow-durable-task-step 2.18
Clone Of:
Environment:
Last Closed: 2018-02-16 02:49:19 UTC
Embargoed:

Attachments (Terms of Use)

Description Adam Mariš 2018-01-22 16:13:34 UTC 
On instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did not prevent the execution of node blocks on those agents due to incorrect permissions checks in Pipeline: Nodes and Processes plugin.

Affects versions up to and including 2.17.

External References:

https://jenkins.io/security/advisory/2018-01-22/
Note You need to log in before you can comment on or make changes to this bug.