ASA-2019-00102 – Jenkins: Session fixation vulnerability in GitHub Authentication Plugin

Posted on by Allele Security Intelligence in Alerts

Allele Security Alert

ASA-2019-00102

Identifier(s)

ASA-2019-00102, SECURITY-797, CVE-2019-1003019

Title

Session fixation vulnerability in GitHub Authentication Plugin

Vendor(s)

CloudBees, Inc

Product(s)

Jenkins

Affected version(s)

GitHub Authentication Plugin up to and including 0.29

Fixed version(s)

GitHub Authentication Plugin version 0.31

Proof of concept

Unknown

Description

GitHub Authentication Plugin did not invalidate the previous session and create a new one upon successful login, allowing attackers able to control or obtain another user’s pre-login session ID to impersonate them.

Technical details

Unknown

Credits

Wadeck Follonier (CloudBees, Inc)

Reference(s)

Jenkins Security Advisory 2019-01-28
https://jenkins.io/security/advisory/2019-01-28

Jenkins Plugins
https://plugins.jenkins.io/github-oauth

CVE-2019-1003019
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1003019

CVE-2019-1003019
https://nvd.nist.gov/vuln/detail/CVE-2019-1003019

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: February 24, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.