Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 16 Jan 2019 17:51:47 +0100
From: Daniel Beck <>
Subject: Multiple vulnerabilities in Jenkins

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:

* Jenkins weekly 2.160
* Jenkins LTS 2.150.2

Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:

We provide advance notification for security updates on this mailing list:

If you discover security vulnerabilities in Jenkins, please report them as
described here:


Users with the Overall/RunScripts permission (typically administrators) 
were able to use the Jenkins script console to craft a 'Remember me' 
cookie that would never expire.

This allowed attackers access to a Jenkins instance while the 
corresponding user in the configured security realm exists, for example to 
persist access after another successful attack. 

When using an external security realm such as LDAP or Active Directory, 
deleting a user from the security realm does not result in the user losing 
access to Jenkins.

While deleting the user record from Jenkins did invalidate the 'Remember 
me' cookie, there was no way to invalidate active sessions besides 
restarting Jenkins or terminating sessions through other means, such as 
Monitoring Plugin.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.