An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java that allows attackers with Overall/Administer permission or access to the local file system to obtain credentials entered by users if the form submission could not be successfully processed.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2018 10 10 | — | Upgrade Jenkins to version 2.146Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 2.138.2 | Jan 23, 2019 | Jan 9, 2019 |
| Redhat Openshift | — | Upgrade golang-github-openshift-oauth-proxyUpgrade openshift-monitor-project-lifecycleUpgrade openshift-enterprise-autohealUpgrade cri-oUpgrade atomic-openshift-node-problem-detectorUpgrade jenkinsUpgrade atomic-openshift-web-consoleUpgrade golang-github-prometheus-prometheusUpgrade atomic-openshift-dockerregistryUpgrade openshift-enterprise-cluster-capacityUpgrade openshift-ansibleUpgrade atomic-enterprise-service-catalogUpgrade golang-github-prometheus-alertmanagerUpgrade openshift-monitor-sample-appUpgrade atomic-openshiftUpgrade jenkins-2-pluginsUpgrade atomic-openshift-deschedulerUpgrade atomic-openshift-service-idlerUpgrade kibanaUpgrade atomic-openshift-metrics-serverUpgrade atomic-openshift-cluster-autoscalerUpgrade golang-github-prometheus-node_exporter | Apr 15, 2019 | Oct 10, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub