Re: Multiple vulnerabilities in Jenkins

[Daniel Beck <ml () beckweb net>]

> On 16. Jan 2019, at 17:51, Daniel Beck <ml () beckweb net> wrote:
>
> SECURITY-868
> Users with the Overall/RunScripts permission (typically administrators) 
> were able to use the Jenkins script console to craft a 'Remember me' 
> cookie that would never expire.
>
> This allowed attackers access to a Jenkins instance while the 
> corresponding user in the configured security realm exists, for example to 
> persist access after another successful attack. 

CVE-2019-1003003

> SECURITY-901
> When using an external security realm such as LDAP or Active Directory, 
> deleting a user from the security realm does not result in the user losing 
> access to Jenkins.
>
> While deleting the user record from Jenkins did invalidate the 'Remember 
> me' cookie, there was no way to invalidate active sessions besides 
> restarting Jenkins or terminating sessions through other means, such as 
> Monitoring Plugin.

CVE-2019-1003004