Jenkins
Jenkins Security Advisory 2018-06-04
2018-06-04 Jun 4, 2018 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2018-06-04/. 10 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2018-06-04/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
10 lines
Showing 1–10 of 10
CVE-2018-1000187
BR2018-0000-024557
SECURITY-883
unclaimed
Kubernetes Plugin printed sensitive build variables to logs
Credited as Jesse Glick, CloudBees, Inc.
CVE-2018-1000184
BR2018-0000-024558
SECURITY-799
unclaimed
Server-side request forgery vulnerability in GitHub Plugin
Credited as Thomas de Grenier de Latour
CVE-2018-1000183
BR2018-0000-024559
SECURITY-804
unclaimed
CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials
Credited as Thomas de Grenier de Latour
CVE-2018-1000186
BR2018-0000-024560
SECURITY-805
unclaimed
CSRF vulnerability and missing permission checks in GitHub Pull Request Builder Plugin allowed server-side request forgery, capturing credentials
Credited as Thomas de Grenier de Latour
CVE-2018-1000185
BR2018-0000-024561
SECURITY-806
unclaimed
Server-side request forgery vulnerability in GitHub Branch Source Plugin
Credited as Thomas de Grenier de Latour
CVE-2018-1000189
BR2018-0000-024562
SECURITY-807
unclaimed
CSRF vulnerability and missing permission checks in AbsInt Astrée Plugin allowed launching programs on the Jenkins controller
Credited as Thomas de Grenier de Latour
CVE-2018-1000188
BR2018-0000-024563
SECURITY-809
unclaimed
Server-side request forgery vulnerability in CAS Plugin
Credited as Thomas de Grenier de Latour
CVE-2018-1000182
BR2018-0000-024564
SECURITY-810
unclaimed
Server-side request forgery vulnerability in Git Plugin
Credited as Thomas de Grenier de Latour
CVE-2018-1000190
BR2018-0000-024565
SECURITY-865
unclaimed
CSRF vulnerability and missing permission checks in Black Duck Hub Plugin allowed server-side request forgery, capturing credentials
Credited as Thomas de Grenier de Latour
CVE-2018-1000191
BR2018-0000-024566
SECURITY-866
unclaimed
CSRF vulnerability and missing permission checks in Black Duck Detect Plugin allowed server-side request forgery, capturing credentials
Credited as Thomas de Grenier de Latour