Jenkins Security Advisory: Multiple Vulnerabilities (CVE-2018-1999042-047)

Critical Vulnerability Information 1. Jenkins allowed deserialization of URL objects with host components CVE: SECURITY-637 / CVE-2018-1999042 Severity: Low Description: Jenkins allowed deserialization of URL objects via Remoting and XStream, which could be exploited to look up DNS records of specified hosts. Jenkins now injects a URLStreamHandler to prevent this behavior, and this can be disabled by setting to . 2. Ephemeral user record was created on some invalid authentication attempts CVE: SECURITY-672 / CVE-2018-1999043 Severity: Medium Description: Attempting to authenticate using API tokens could result in the creation of many ephemeral user records in memory due to legacy behavior. 3. Cron expression form validation could enter infinite loop CVE: SECURITY-790 / CVE-2018-1999044 Severity: Medium Description: Certain cron expressions could cause the form validation process to enter an infinite loop, blocking request handling threads. 4. "Remember me" cookie was evaluated even if that feature is disabled CVE: SECURITY-996 / CVE-2018-1999045 Severity: Low Description: Even when the "Remember me" feature is disabled, existing "Remember me" cookies could still allow users to log in. 5. Unauthorized users could access agent logs CVE: SECURITY-1071 / CVE-2018-1999046 Severity: Medium Description: Due to missing permission checks, users with certain permissions could access agent logs. 6. Unauthorized users could cancel scheduled restarts from the update center CVE: SECURITY-1076 / CVE-2018-1999047 Severity: Low Description: Users with specific permissions could cancel scheduled restarts initiated from the update center due to insufficient permission checks. Severity SECURITY-637: Low SECURITY-672: Medium SECURITY-790: Medium SECURITY-996: Low SECURITY-1071: Medium SECURITY-1076: Low Affected Versions Jenkins weekly up to and including 2.137 Jenkins LTS up to and including 2.121.2 Fix Jenkins weekly: Upgrade to version 2.138 Jenkins LTS: Upgrade to version 2.121.3 Credit Reporters are acknowledged for discovering and reporting these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: Multiple Vulnerabilities (CVE-2018-1999042-047)