Description
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | unspecified – ≤ 2.244, unspecified – ≤ LTS 2.235.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins | 2.235.2.1597312065-1.el7 | RHSA-2020:3808, RHSA-2020:3519, RHBA-2020:3441 |
| Red Hat OpenShift 4 | openshift +1 | 4.3.37-202009120213.p0.git.0.dffefe4.el8 | RHSA-2020:3808, RHSA-2020:3579, RHSA-2020:3519 |
| Red Hat OpenShift 3 | jenkins | 2.235.2.1597220898-1.el7 | RHSA-2020:3541 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1597310986-1.el7 | RHSA-2020:3541 |
| Red Hat OpenShift 3 | openshift-ansible +4 | 3.11.272-1.git.0.79ab6e9.el7 | RHSA-2020:3541 |
| Red Hat OpenShift 3 | python-rsa +1 | 4.5-2.el7 | RHSA-2020:3541 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | jenkins | 2.245-r0 | — |
| Alpine v3.23 | jenkins | 2.245-r0 | — |
| Alpine v3.22 | jenkins | 2.245-r0 | — |
| Alpine v3.21 | jenkins | 2.245-r0 | — |
| Alpine v3.20 | jenkins | 2.245-r0 | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | jenkins | 2.245-r0 | — |
| Alpine v3.18 | jenkins | 2.245-r0 | — |
| Alpine v3.17 | jenkins | 2.245-r0 | — |
| Alpine v3.16 | jenkins | 2.245-r0 | — |
| Alpine v3.15 | jenkins | 2.245-r0 | — |
| Alpine v3.14 | jenkins | 2.245-r0 | — |
| Alpine v3.13 | jenkins | 2.245-r0 | — |
| Alpine v3.12 | jenkins | 2.245-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.235.2 | 2.235.2 | GHSA-gfhj-524q-gcrm |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.236, < 2.245 | 2.245 | GHSA-gfhj-524q-gcrm |
Advisories 5
- RHSA-2020:3579 Red Hat Security Advisory: OpenShift Container Platform 4.4.19 openshift security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2020:3808 Red Hat Security Advisory: OpenShift Container Platform 4.3.38 jenkins and openshift security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2020:3541 Red Hat Security Advisory: OpenShift Container Platform 3.11 security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2020:3519 Red Hat Security Advisory: OpenShift Container Platform 4.5.7 jenkins and openshift packages security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHBA-2020:3441 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.4.18 packages update Red Hat Security Advisories (RHSA) · Aug 8, 2026