Description
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | unspecified – ≤ 2.227, unspecified – ≤ LTS 2.204.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | atomic-enterprise-service-catalog +1 | 1:4.3.25-202006081518.git.1.52b3a66.el7 | RHBA-2020:2444, RHBA-2020:2435 |
| Red Hat OpenShift 4 | atomic-openshift-service-idler | 4.3.25-202006081518.git.1.79365c5.el7 | RHBA-2020:2444, RHBA-2020:2435 |
| Red Hat OpenShift 4 | conmon | 2:2.0.17-1.rhaos4.3.el7 | RHBA-2020:2444, RHBA-2020:2435 |
| Red Hat OpenShift 4 | cri-o | 1.16.6-15.dev.rhaos4.3.gitebc053b.el7 | RHBA-2020:2444, RHBA-2020:2435 |
| Red Hat OpenShift 4 | jenkins | 2.222.1.1591349991-1.el7 | RHBA-2020:2444, RHBA-2020:2435 |
| Red Hat OpenShift 4 | machine-config-daemon | 4.3.25-202006081518.git.1.478b31a.el8 | RHBA-2020:2444, RHBA-2020:2435 |
| Red Hat OpenShift 4 | openshift +1 | 4.3.25-202006060952.git.1.96c30f6.el7 | RHBA-2020:2444, RHBA-2020:2435 |
| Red Hat OpenShift 4 | openshift-ansible +1 | 4.3.25-202006060952.git.1.1253fde.el7 | RHBA-2020:2444, RHBA-2020:2435 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.3.25-202006060952.git.1.fd93102.el7 | RHBA-2020:2444, RHBA-2020:2435 |
| Red Hat OpenShift 4 | openshift-kuryr +4 | 4.3.25-202006081518.git.1.240b401.el8 | RHBA-2020:2444, RHBA-2020:2435 |
| Red Hat OpenShift 4 | s390utils +12 | 2:2.6.0-23.el8 | RHBA-2020:2435 |
| Red Hat OpenShift 3 | jenkins | 2.222.1.1591351669-1.el7 | RHBA-2020:2477 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | jenkins | 2.228-r0 | — |
| Alpine v3.23 | jenkins | 2.228-r0 | — |
| Alpine v3.22 | jenkins | 2.228-r0 | — |
| Alpine v3.21 | jenkins | 2.228-r0 | — |
| Alpine v3.20 | jenkins | 2.228-r0 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | jenkins | 2.228-r0 | — |
| Alpine v3.18 | jenkins | 2.228-r0 | — |
| Alpine v3.17 | jenkins | 2.228-r0 | — |
| Alpine v3.16 | jenkins | 2.228-r0 | — |
| Alpine v3.15 | jenkins | 2.228-r0 | — |
| Alpine v3.14 | jenkins | 2.228-r0 | — |
| Alpine v3.13 | jenkins | 2.228-r0 | — |
| Alpine v3.12 | jenkins | 2.228-r0 | — |
| Alpine v3.11 | jenkins | 2.228-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.228 | 2.228 | GHSA-crg2-6xv3-qg5f |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.204.6, < 2.228 | 2.228 | GHSA-crg2-6xv3-qg5f |
Advisories 3
- RHBA-2020:2477 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHBA-2020:2444 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.4.8 packages update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHBA-2020:2435 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.25 packages update Red Hat Security Advisories (RHSA) · Jun 27, 2026