CVE-2018-1000863: Path Traversal
First published: Mon Dec 10 2018(Updated: )
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.jenkins-ci.main:jenkins-core | >=2.140<=2.153 | 2.154 |
| maven/org.jenkins-ci.main:jenkins-core | <=2.138.3 | 2.138.4 |
| Jenkins | <=2.138.3 | |
| Jenkins | <=2.153 | |
| redhat openshift container platform | =3.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/106176
- https://access.redhat.com/errata/RHBA-2019:0024
- https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072
- https://www.tenable.com/security/research/tra-2018-43
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000863
- https://github.com/jenkinsci/jenkins/commit/4ed66e5838476e575a83c3cd13fffb37eefa2f48
- https://github.com/jenkinsci/jenkins/commit/7bae6dd6ef23af988801d38dc0f8f693bc6283f8
- https://github.com/advisories/GHSA-4jhm-5f7g-75fp (Advisory)
Frequently Asked Questions
What is the severity of CVE-2018-1000863?
CVE-2018-1000863 is classified as a medium severity vulnerability.
How do I fix CVE-2018-1000863?
To fix CVE-2018-1000863, upgrade Jenkins to version 2.154 or later, or LTS version 2.138.4 or later.
What is the impact of CVE-2018-1000863 on Jenkins?
CVE-2018-1000863 allows attackers to submit malicious user names, potentially preventing users from logging into Jenkins.
Which versions of Jenkins are affected by CVE-2018-1000863?
Jenkins versions 2.153 and earlier, as well as LTS version 2.138.3 and earlier are affected by CVE-2018-1000863.
Is CVE-2018-1000863 associated with specific software distributions?
Yes, CVE-2018-1000863 is associated with Jenkins and Red Hat OpenShift Container Platform version 3.11.
- collector/github-advisory-latest
- alias/GHSA-4jhm-5f7g-75fp
- alias/CVE-2018-1000863
- collector/github-advisory
- agent/type
- agent/author
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/maven
- vendor/jenkins
- canonical/jenkins
- version/jenkins/2.138.3
- version/jenkins/2.153
- vendor/redhat
- canonical/redhat openshift container platform
- version/redhat openshift container platform/3.11