Description
Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Mercurial Plugin | unspecified – ≤ 2.11 | 2.10.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.19.1-2.rhaos4.6.git2af9ecf.el8 | RHSA-2021:0038 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.4.1611203637-1.el7 | RHSA-2021:0282, RHSA-2021:0038, RHSA-2021:0034 |
| Red Hat OpenShift 4 | openshift +1 | 4.6.0-202012190744.p0.git.94235.c62c6f7.el7 | RHSA-2021:0038 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.6.0-202012172338.p0.git.3800.30af700.el7 | RHSA-2021:0038 |
| Red Hat OpenShift 4 | python-urllib3 +1 | 1.26.2-1.el7 | RHSA-2021:0034 |
| Red Hat OpenShift 3 | jenkins | 2.263.3.1612433584-1.el7 | RHSA-2021:0637 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1612862361-1.el7 | RHSA-2021:0637 |
| Red Hat OpenShift 3 | python-rsa +1 | 4.5-3.el7 | RHSA-2021:0637 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:mercurial | >= 2.11, < 2.12 | 2.12 | GHSA-x58r-wxc3-7pqr |
| Maven | org.jenkins-ci.plugins:mercurial | >= 2.10, < 2.10.1 | 2.10.1 | GHSA-x58r-wxc3-7pqr |
| Maven | org.jenkins-ci.plugins:mercurial | >= 2.9, < 2.9.1 | 2.9.1 | GHSA-x58r-wxc3-7pqr |
| Maven | org.jenkins-ci.plugins:mercurial | < 2.8.1 | 2.8.1 | GHSA-x58r-wxc3-7pqr |
Advisories 4
- RHSA-2021:0038 Red Hat Security Advisory: OpenShift Container Platform 4.6.12 packages and security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0637 Red Hat Security Advisory: OpenShift Container Platform 3.11.394 bug fix and security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2021:0034 Red Hat Security Advisory: OpenShift Container Platform 4.5.27 packages and security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0282 Red Hat Security Advisory: OpenShift Container Platform 4.4.33 packages and security update Red Hat Security Advisories (RHSA) · Nov 22, 2025