Description
XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CloudBees | Jenkins | before 1.600 | — |
| CloudBees | Jenkins LTS | before 1.596.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 2 | jenkins | 1.609.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-broker | 1.16.2.10-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-broker-util | 1.36.2.2-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-diy | 1.26.1.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jbosseap | 2.26.3.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jbossews | 1.34.3.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jenkins | 1.28.2.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-mock | 1.22.1.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-nodejs | 1.33.1.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-perl +1 | 1.30.1.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-php | 1.34.1.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-python | 1.33.3.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-ruby | 1.32.1.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-logshifter | 1.10.1.2-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | openshift-origin-node-util | 1.37.2.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | rhc | 1.37.1.2-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-console | 1.35.2.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-controller | 1.37.3.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-frontend-apache-vhost | 0.12.4.2-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-gear-placement | 0.0.2.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-msg-broker-mcollective | 1.35.3.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-node | 1.37.1.1-1.el6op | RHSA-2015:1844 |
| Red Hat OpenShift 2 | rubygem-openshift-origin-routing-daemon | 0.25.1.2-1.el6op | RHSA-2015:1844 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 1.597, < 1.600 | 1.600 | GHSA-qj27-w92h-fc9r |
| Maven | org.jenkins-ci.main:jenkins-core | < 1.596.1 | 1.596.1 | GHSA-qj27-w92h-fc9r |
Advisories 1
- RHSA-2015:1844 Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2.7 security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026