Skip to content
OpenAdvisories
Medium · 6.5 CVE-2021-21602 BIT-jenkins-2021-21602EUVD-2022-5395GHSA-vpjm-58cw-r8q5

Arbitrary file read vulnerability in workspace browsers in Jenkins

Published Jan 13, 2021 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Package: jenkins Package: org.jenkins-ci.main:jenkins-core Category: Web / CMS Ecosystem: Alpine Ecosystem: Maven

Description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins unspecified – ≤ 2.274, unspecified – ≤ LTS 2.263.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 4 afterburn +1 5.0.0-1.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 atomic-openshift-service-idler 4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8 RHSA-2021:2437
Red Hat OpenShift 4 butane 0.12.1-1.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 conmon 2:2.0.21-1.rhaos4.5.el7 RHSA-2021:0429
Red Hat OpenShift 4 console-login-helper-messages +2 0.20.3-1.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 coreos-installer +1 0.9.0-6.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 cri-o 1.21.2-5.rhaos4.8.gitb27d974.el7 RHSA-2021:2437
Red Hat OpenShift 4 cri-tools 1.21.0-2.el7 RHSA-2021:2437
Red Hat OpenShift 4 haproxy 2.2.13-1.el7 RHSA-2021:2437
Red Hat OpenShift 4 ignition +1 2.9.0-6.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 ironic-images +3 2021.1-20210614.1.el8 RHSA-2021:2437
Red Hat OpenShift 4 jenkins 2.263.3.1612434332-1.el7 RHSA-2021:2437, RHSA-2021:0429, RHSA-2021:0423
Red Hat OpenShift 4 jenkins-2-plugins 4.8.1624022417-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 kata-containers 2.1.0-4.el8 RHSA-2021:2437
Red Hat OpenShift 4 machine-config-daemon 4.5.0-202102050524.p0.git.2594.ff3b8c0.el8 RHSA-2021:0429
Red Hat OpenShift 4 openshift +1 4.5.0-202102050524.p0.git.0.9229406.el7 RHSA-2021:2437, RHSA-2021:0429
Red Hat OpenShift 4 openshift-ansible +1 4.5.0-202102031005.p0.git.0.c6839a2.el7 RHSA-2021:2437, RHSA-2021:0429
Red Hat OpenShift 4 openshift-clients +1 4.5.0-202102051529.p0.git.3612.61b096a.el7 RHSA-2021:2437, RHSA-2021:0429
Red Hat OpenShift 4 openshift-kuryr +4 4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8 RHSA-2021:2437
Red Hat OpenShift 4 openstack-ironic +4 1:17.0.4-0.20210713221218.a415e7e.el8 RHSA-2021:2437
Red Hat OpenShift 4 openstack-ironic-inspector +4 10.6.1-0.20210406091336.579f59c.el8 RHSA-2021:2437
Red Hat OpenShift 4 openvswitch2.15 +3 2.15.0-9.el8fdp RHSA-2021:2437
Red Hat OpenShift 4 ostree +3 2020.7-5.el8_4 RHSA-2021:2437
Red Hat OpenShift 4 ovn2.13 +3 20.12.0-25.el8fdp RHSA-2021:2437
Red Hat OpenShift 4 podman +3 3.0.1-6.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-debtcollector +1 2.2.0-0.20210324220630.649189d.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-eventlet +1 0.25.2-4.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-hardware +2 0.27.0-0.20210406121246.756fedb.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-ironic-lib +1 4.6.2-0.20210608101214.ca2e4ba.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-ironic-prometheus-exporter +1 2.2.1-0.20210325143713.70e39c8.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-jsonschema +1 3.2.0-5.el8ost RHSA-2021:2437
Red Hat OpenShift 4 python-keystoneauth1 +1 4.3.0-0.20210325001456.6a66271.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-kubernetes +2 12.0.1-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-openshift +1 1:0.12.1-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-openstacksdk +2 0.53.0-0.20210325011601.4629245.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-concurrency +3 4.4.0-0.20210325004915.7dcf9e9.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-config +1 2:8.5.0-0.20210325050501.cfa2564.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-context +1 3.2.0-0.20210325043103.0d02866.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-db +3 8.5.0-0.20210325041241.503db60.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-i18n +2 5.0.1-0.20210324221600.73187bd.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-log +3 4.4.0-0.20210409081224.9b29c90.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-policy +2 3.7.0-0.20210325051823.d853485.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-serialization +2 4.1.0-0.20210325012242.8445e61.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-service +2 2.5.0-0.20210325014731.d25e454.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-upgradecheck +1 1.3.0-0.20210325003851.9f95a6e.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-utils +3 4.8.0-0.20210325043201.3288539.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-pyrsistent +1 0.16.0-3.el8ost RHSA-2021:2437
Red Hat OpenShift 4 python-stevedore +1 3.3.0-0.20210325001012.7d7154f.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-sushy +2 3.7.1-0.20210428165244.bc49878.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-sushy-oem-idrac +2 2.0.1-0.20210326152858.83b7eb0.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-tooz +1 2.8.0-0.20210324235001.54448e9.el8 RHSA-2021:2437
Red Hat OpenShift 4 python3-ironic-python-agent +1 7.0.2-0.20210611153100.bfa97cb.el8 RHSA-2021:2437
Red Hat OpenShift 4 redhat-release-coreos 48.84-4.el8 RHSA-2021:2437
Red Hat OpenShift 4 rteval-loads 1.4-12.el8 RHSA-2021:2437
Red Hat OpenShift 4 runc 1.0.0-72.rhaos4.5.giteadfc6b.el8 RHSA-2021:2437, RHSA-2021:0429
Red Hat OpenShift 4 stress-ng 0.12.06-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 toolbox 0.0.8-3.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 3 jenkins 2.263.3.1612433584-1.el7 RHSA-2021:0637
Red Hat OpenShift 3 jenkins-2-plugins 3.11.1612862361-1.el7 RHSA-2021:0637
Red Hat OpenShift 3 python-rsa +1 4.5-3.el7 RHSA-2021:0637

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 jenkins 2.275-r0 —
Alpine v3.23 jenkins 2.275-r0 —
Alpine v3.22 jenkins 2.275-r0 —
Alpine v3.21 jenkins 2.275-r0 —
Alpine v3.20 jenkins 2.275-r0 —
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 jenkins 2.275-r0 —
Alpine v3.18 jenkins 2.275-r0 —
Alpine v3.17 jenkins 2.275-r0 —
Alpine v3.16 jenkins 2.275-r0 —
Alpine v3.15 jenkins 2.275-r0 —
Alpine v3.14 jenkins 2.275-r0 —
Alpine v3.13 jenkins 2.275-r0 —
Alpine v3.12 jenkins 2.275-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.main:jenkins-core < 2.263.2 2.263.2 GHSA-vpjm-58cw-r8q5
Maven org.jenkins-ci.main:jenkins-core >= 2.264, < 2.275 2.275 GHSA-vpjm-58cw-r8q5

Advisories 4

References