Description
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | jenkins | 2.138.4.1544416383-1.el7 | RHBA-2019:0024 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.138.4 | 2.138.4 | GHSA-hph9-9vcq-f7gp |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.140, < 2.154 | 2.154 | GHSA-hph9-9vcq-f7gp |
Advisories 1
- RHBA-2019:0024 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- https://jenkins.io/security/advisory/2018-12-05/#SECURITY-904
- RHBA-2019:0024 vendor-advisory
- 106176 vdb-entry