rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-1002101 kubectl cp path traversal
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.
Problem types: description: Data Handling
Affected products: vendor: Kubernetes
product: Kubernetes
Credits: lang: en
value: Ariel Zelivansky of Twistlock
Published: 2019-04-01T14:14:27.768Z
CVE-2019-1003000 
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Script Security Plugin
Published: 2019-01-22T14:00:00.000Z
CVE-2019-1003001 
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Pipeline: Groovy Plugin
Published: 2019-01-22T14:00:00.000Z
CVE-2019-1003002 
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Pipeline: Declarative Plugin
Published: 2019-01-22T14:00:00.000Z
CVE-2019-1003003 
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-01-22T14:00:00.000Z
CVE-2019-1003004 
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-01-22T14:00:00.000Z
CVE-2019-1003005 
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins Script Security Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003006 
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins Groovy Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003007 
A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.
Affected products: vendor: Jenkins project
product: Jenkins Warnings Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003008 
A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.
Affected products: vendor: Jenkins project
product: Jenkins Warnings Next Generation Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003009 
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.
Affected products: vendor: Jenkins project
product: Jenkins Active Directory Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003010 
A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record.
Affected products: vendor: n/a
product: n/a
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003011 
An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.
Affected products: vendor: Jenkins project
product: Jenkins Token Macro Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003012 
A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API.
Affected products: vendor: Jenkins project
product: Jenkins Blue Ocean Plugins
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003013 
An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
Affected products: vendor: Jenkins project
product: Jenkins Blue Ocean Plugins
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003014 
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
Affected products: vendor: Jenkins project
product: Jenkins Config File Provider Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003015 
An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried in preparation of job import to read arbitrary files, perform a denial of service attack, etc.
Affected products: vendor: Jenkins project
product: Jenkins Job Import Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003016 
An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java, src/main/java/org/jenkins/ci/plugins/jobimport/model/JenkinsSite.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Job Import Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003017 
A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job's configuration.
Affected products: vendor: Jenkins project
product: Jenkins Job Import Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003018 
An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.
Affected products: vendor: Jenkins project
product: Jenkins GitHub Authentication Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003019 
An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
Affected products: vendor: Jenkins project
product: Jenkins GitHub Authentication Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003020 
A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with Overall/Read permission to submit a GET request to an attacker-specified URL.
Affected products: vendor: Jenkins project
product: Jenkins Kanboard Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003021 
An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.
Affected products: vendor: Jenkins project
product: Jenkins OpenId Connect Authentication Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003022 
A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master.
Affected products: vendor: Jenkins project
product: Jenkins Monitoring Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003023 
A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourcePrinter.java, src/main/java/io/jenkins/plugins/analysis/core/util/Sanitizer.java, src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML.
Affected products: vendor: Jenkins project
product: Jenkins Warnings Next Generation Plugin
Published: 2019-02-06T16:00:00.000Z
CVE-2019-1003024 
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins Script Security Plugin
Published: 2019-02-20T21:00:00.000Z
CVE-2019-1003025 
A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Cloud Foundry Plugin
Published: 2019-02-20T21:00:00.000Z
CVE-2019-1003026 
A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message.
Affected products: vendor: Jenkins project
product: Jenkins Mattermost Notification Plugin
Published: 2019-02-20T21:00:00.000Z
CVE-2019-1003027 
A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL and obtain the HTTP response code if successful, and exception error message otherwise.
Affected products: vendor: Jenkins project
product: Jenkins OctopusDeploy Plugin
Published: 2019-02-20T21:00:00.000Z
CVE-2019-1003028 
A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthenticationMethod.java that allows attackers with Overall/Read permission to have Jenkins connect to a JMS endpoint.
Affected products: vendor: Jenkins project
product: Jenkins JMS Messaging Plugin
Published: 2019-02-20T21:00:00.000Z
CVE-2019-1003029 
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins Script Security Plugin
Published: 2019-03-08T21:00:00.000Z
CVE-2019-1003030 
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Groovy Plugin
Published: 2019-03-08T21:00:00.000Z
CVE-2019-1003031 
A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins Matrix Project Plugin
Published: 2019-03-08T21:00:00.000Z
CVE-2019-1003032 
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins Email Extension Plugin
Published: 2019-03-08T21:00:00.000Z
CVE-2019-1003033 
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins Groovy Plugin
Published: 2019-03-08T21:00:00.000Z
CVE-2019-1003034 
A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM.
Affected products: vendor: Jenkins project
product: Jenkins Job DSL Plugin
Published: 2019-03-08T21:00:00.000Z
CVE-2019-1003035 
An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgentTemplate.java, src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Overall/Read permission to perform the 'verify configuration' form validation action, thereby obtaining limited information about the Azure configuration.
Affected products: vendor: Jenkins project
product: Jenkins Azure VM Agents Plugin
Published: 2019-03-08T21:00:00.000Z
CVE-2019-1003036 
A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgent.java that allows attackers with Overall/Read permission to attach a public IP address to an Azure VM agent.
Affected products: vendor: Jenkins project
product: Jenkins Azure VM Agents Plugin
Published: 2019-03-08T21:00:00.000Z
CVE-2019-1003037 
An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Azure VM Agents Plugin
Published: 2019-03-08T21:00:00.000Z
CVE-2019-1003038 
An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the password stored in the plugin configuration.
Affected products: vendor: Jenkins project
product: Jenkins Repository Connector Plugin
Published: 2019-03-08T21:00:00.000Z
CVE-2019-1003039 
An insufficiently protected credentials vulnerability exists in JenkinsAppDynamics Dashboard Plugin 1.0.14 and earlier in src/main/java/nl/codecentric/jenkins/appd/AppDynamicsResultsPublisher.java that allows attackers without permission to obtain passwords configured in jobs to obtain them.
Affected products: vendor: Jenkins project
product: JenkinsAppDynamics Dashboard Plugin
Published: 2019-03-08T21:00:00.000Z
CVE-2019-1003040 
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
Affected products: vendor: Jenkins project
product: Jenkins Script Security Plugin
Published: 2019-03-28T17:59:29.000Z
CVE-2019-1003041 
A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Groovy Plugin
Published: 2019-03-28T17:59:29.000Z
CVE-2019-1003042 
A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.
Affected products: vendor: Jenkins project
product: Jenkins Lockable Resources Plugin
Published: 2019-03-28T17:59:29.000Z
CVE-2019-1003043 
A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Slack Notification Plugin
Published: 2019-03-28T17:59:29.000Z
CVE-2019-1003044 
A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Slack Notification Plugin
Published: 2019-03-28T17:59:29.000Z
CVE-2019-1003045 
A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenkins home directory to obtain the API token configured in this plugin's configuration.
Affected products: vendor: Jenkins project
product: Jenkins ECS Publisher Plugin
Published: 2019-03-28T17:59:29.000Z
CVE-2019-1003046 
A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Fortify on Demand Uploader Plugin
Published: 2019-03-28T17:59:29.000Z
CVE-2019-1003047 
A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products: vendor: Jenkins project
product: Jenkins Fortify on Demand Uploader Plugin
Published: 2019-03-28T17:59:29.000Z
CVE-2019-1003048 
A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted password from the plugin configuration.
Affected products: vendor: Jenkins project
product: Jenkins PRQA Plugin
Published: 2019-03-28T17:59:30.000Z
CVE-2019-1003049 
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2019-04-10T20:12:29.000Z