Description
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | 2.275, LTS 2.263.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | conmon | 2:2.0.21-1.rhaos4.5.el7 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | jenkins | 2.263.3.1612434332-1.el7 | RHSA-2021:0429, RHSA-2021:0423 |
| Red Hat OpenShift 4 | machine-config-daemon | 4.5.0-202102050524.p0.git.2594.ff3b8c0.el8 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | openshift +1 | 4.5.0-202102050524.p0.git.0.9229406.el7 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | openshift-ansible +1 | 4.5.0-202102031005.p0.git.0.c6839a2.el7 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.5.0-202102051529.p0.git.3612.61b096a.el7 | RHSA-2021:0429 |
| Red Hat OpenShift 4 | runc | 1.0.0-72.rhaos4.5.giteadfc6b.el8 | RHSA-2021:0429 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.13 | jenkins | 2.281-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.263.3 | 2.263.3 | GHSA-qxp6-27gw-99cj |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.264, < 2.276 | 2.276 | GHSA-qxp6-27gw-99cj |
Advisories 2
- RHSA-2021:0429 Red Hat Security Advisory: OpenShift Container Platform 4.5.33 packages and security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2021:0423 Red Hat Security Advisory: OpenShift Container Platform 4.6.17 security and packages update Red Hat Security Advisories (RHSA) · Aug 12, 2026