Description
Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift +14 | 3.6.173.0.21-1.git.0.f95b0e7.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | fluentd +1 | 0.12.39-2.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.7.1502412812-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | kibana | 4.6.4-3.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-cool.io +1 | 1.5.1-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-excon +1 | 0.58.0-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-faraday +1 | 0.13.0-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-fluent-plugin-kubernetes_metadata_filter +1 | 0.29.0-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-fluent-plugin-viaq_data_model +1 | 0.0.5-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-i18n +1 | 0.8.6-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-systemd-journal +1 | 1.3.0-1.el7 | RHBA-2017:2642 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:pipeline-build-step | < 2.5.1 | 2.5.1 | GHSA-8jx9-7j5m-79x4 |
Advisories 1
- RHBA-2017:2642 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.6.1 bug fix and enhancement update Red Hat Security Advisories (RHSA) · May 13, 2026