Description
Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift +14 | 3.6.173.0.21-1.git.0.f95b0e7.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | fluentd +1 | 0.12.39-2.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.7.1502412812-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | kibana | 4.6.4-3.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-cool.io +1 | 1.5.1-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-excon +1 | 0.58.0-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-faraday +1 | 0.13.0-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-fluent-plugin-kubernetes_metadata_filter +1 | 0.29.0-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-fluent-plugin-viaq_data_model +1 | 0.0.5-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-i18n +1 | 0.8.6-1.el7 | RHBA-2017:2642 |
| Red Hat OpenShift 3 | rubygem-systemd-journal +1 | 1.3.0-1.el7 | RHBA-2017:2642 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:git | < 3.3.2 | 3.3.2 | GHSA-rf5q-8gx3-xqfc |
Advisories 1
- RHBA-2017:2642 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.6.1 bug fix and enhancement update Red Hat Security Advisories (RHSA) · May 13, 2026