Description
CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | 2.185 and earlier, LTS 2.176.1 and earlier | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins | 2.176.2.1563461785-1.el7 | RHSA-2019:2548 |
| Red Hat OpenShift 3 | jenkins | 2.176.2.1563460897-1.el7 | RHSA-2019:2503 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.176.2 | 2.176.2 | GHSA-hcxf-rq72-h4rr |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.177, < 2.186 | 2.186 | GHSA-hcxf-rq72-h4rr |
Advisories 2
- RHSA-2019:2548 Red Hat Security Advisory: OpenShift Container Platform 4.1 jenkins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2019:2503 Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- [oss-security] 20190717 Multiple vulnerabilities in Jenkins mailing-list
- 109373 vdb-entry
- RHSA-2019:2503 vendor-advisory
- RHSA-2019:2548 vendor-advisory
- https://jenkins.io/security/advisory/2019-07-17/#SECURITY-626