Unauthenticated users could provide maliciously crafted login credentials that cause Jenkins to move the config.xml file from the Jenkins home directory. This configuration file contains basic configuration of Jenkins, including the selected security realm and authorization strategy. If Jenkins is started without this file present, it will revert to the legacy defaults of granting administrator access to anonymous users.
This issue was caused by the fix for SECURITY-499 in the 2017-11-08 security advisory
Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1609610]