Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 23 Jan 2019 11:17:46 +0100
From: Daniel Beck <>
Subject: Re: Multiple vulnerabilities in Jenkins

> On 16. Jan 2019, at 17:51, Daniel Beck <> wrote:
> Users with the Overall/RunScripts permission (typically administrators) 
> were able to use the Jenkins script console to craft a 'Remember me' 
> cookie that would never expire.
> This allowed attackers access to a Jenkins instance while the 
> corresponding user in the configured security realm exists, for example to 
> persist access after another successful attack. 


> When using an external security realm such as LDAP or Active Directory, 
> deleting a user from the security realm does not result in the user losing 
> access to Jenkins.
> While deleting the user record from Jenkins did invalidate the 'Remember 
> me' cookie, there was no way to invalidate active sessions besides 
> restarting Jenkins or terminating sessions through other means, such as 
> Monitoring Plugin.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.