← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to retired/CVE-2018-6356

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
retired/CVE-2018-6356
1
 
Candidate: CVE-2018-6356
2
 
PublicDate: 2018-02-20
3
 
References:
4
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6356
5
 
Description:
6
 
 Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent
7
 
 specifying relative paths that escape a base directory for URLs accessing
8
 
 plugin resource files. This allowed users with Overall/Read permission to
9
 
 download files from the Jenkins master they should not have access to. On
10
 
 Windows, any file accessible to the Jenkins master process could be
11
 
 downloaded. On other operating systems, any file within the Jenkins home
12
 
 directory accessible to the Jenkins master process could be downloaded.
13
 
Ubuntu-Description:
14
 
Notes:
15
 
Bugs:
16
 
Priority: untriaged
17
 
Discovered-by:
18
 
Assigned-to:
19
 
 
20
 
 
21
 
Patches_jenkins:
22
 
upstream_jenkins: needs-triage
23
 
precise/esm_jenkins: DNE
24
 
trusty_jenkins: DNE
25
 
xenial_jenkins: DNE
26
 
artful_jenkins: DNE
27
 
devel_jenkins: DNE