Skip to content
OpenAdvisories
High · 8.1 CVE-2021-21642 EUVD-2022-4915GHSA-q7xg-hh3q-hc68

XML External Entity Reference vulnerability in Jenkins Config File Provider Plugin

Published Apr 21, 2021 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Config File Provider Plugin Package: org.jenkins-ci.plugins:config-file-provider Category: Web / CMS Ecosystem: Maven

Description

Jenkins Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Config File Provider Plugin unspecified – ≤ 3.7.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 4 afterburn +1 5.0.0-1.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 atomic-openshift-service-idler 4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8 RHSA-2021:2437
Red Hat OpenShift 4 butane 0.12.1-1.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 console-login-helper-messages +2 0.20.3-1.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 coreos-installer +1 0.9.0-6.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 cri-o 1.20.2-12.rhaos4.7.git9f7be76.el7 RHSA-2021:2437, RHSA-2021:2122
Red Hat OpenShift 4 cri-tools 1.20.0-3.el7 RHSA-2021:2437, RHSA-2021:2122
Red Hat OpenShift 4 haproxy 2.2.13-1.el7 RHSA-2021:2437
Red Hat OpenShift 4 ignition +1 2.9.0-6.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 ironic-images +3 2021.1-20210614.1.el8 RHSA-2021:2437
Red Hat OpenShift 4 jenkins 2.277.3.1623846768-1.el7 RHSA-2021:2437, RHSA-2021:2431
Red Hat OpenShift 4 jenkins-2-plugins 4.5.1623326336-1.el7 RHSA-2021:2437, RHSA-2021:2431, RHSA-2021:2122
Red Hat OpenShift 4 kata-containers 2.1.0-4.el8 RHSA-2021:2437
Red Hat OpenShift 4 openshift +1 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7 RHSA-2021:2437
Red Hat OpenShift 4 openshift-ansible +1 4.8.0-202106281541.p0.git.626f7a3.assembly.stream.el7 RHSA-2021:2437
Red Hat OpenShift 4 openshift-clients +1 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el7 RHSA-2021:2437
Red Hat OpenShift 4 openshift-kuryr +4 4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8 RHSA-2021:2437
Red Hat OpenShift 4 openstack-ironic +4 1:17.0.4-0.20210713221218.a415e7e.el8 RHSA-2021:2437
Red Hat OpenShift 4 openstack-ironic-inspector +4 10.6.1-0.20210406091336.579f59c.el8 RHSA-2021:2437
Red Hat OpenShift 4 openvswitch2.15 +3 2.15.0-9.el8fdp RHSA-2021:2437
Red Hat OpenShift 4 ostree +3 2020.7-5.el8_4 RHSA-2021:2437
Red Hat OpenShift 4 ovn2.13 +3 20.12.0-25.el8fdp RHSA-2021:2437
Red Hat OpenShift 4 podman +3 3.0.1-6.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-debtcollector +1 2.2.0-0.20210324220630.649189d.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-eventlet +1 0.25.2-4.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-hardware +2 0.27.0-0.20210406121246.756fedb.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-ironic-lib +1 4.6.2-0.20210608101214.ca2e4ba.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-ironic-prometheus-exporter +1 2.2.1-0.20210325143713.70e39c8.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-jsonschema +1 3.2.0-5.el8ost RHSA-2021:2437
Red Hat OpenShift 4 python-keystoneauth1 +1 4.3.0-0.20210325001456.6a66271.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-kubernetes +2 12.0.1-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-openshift +1 1:0.12.1-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-openstacksdk +2 0.53.0-0.20210325011601.4629245.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-concurrency +3 4.4.0-0.20210325004915.7dcf9e9.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-config +1 2:8.5.0-0.20210325050501.cfa2564.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-context +1 3.2.0-0.20210325043103.0d02866.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-db +3 8.5.0-0.20210325041241.503db60.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-i18n +2 5.0.1-0.20210324221600.73187bd.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-log +3 4.4.0-0.20210409081224.9b29c90.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-policy +2 3.7.0-0.20210325051823.d853485.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-serialization +2 4.1.0-0.20210325012242.8445e61.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-service +2 2.5.0-0.20210325014731.d25e454.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-upgradecheck +1 1.3.0-0.20210325003851.9f95a6e.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-utils +3 4.8.0-0.20210325043201.3288539.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-pyrsistent +1 0.16.0-3.el8ost RHSA-2021:2437
Red Hat OpenShift 4 python-stevedore +1 3.3.0-0.20210325001012.7d7154f.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-sushy +2 3.7.1-0.20210428165244.bc49878.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-sushy-oem-idrac +2 2.0.1-0.20210326152858.83b7eb0.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-tooz +1 2.8.0-0.20210324235001.54448e9.el8 RHSA-2021:2437
Red Hat OpenShift 4 python3-ironic-python-agent +1 7.0.2-0.20210611153100.bfa97cb.el8 RHSA-2021:2437
Red Hat OpenShift 4 redhat-release-coreos 47.83-2.el8 RHSA-2021:2437, RHSA-2021:2122
Red Hat OpenShift 4 rteval-loads 1.4-12.el8 RHSA-2021:2437
Red Hat OpenShift 4 runc 1.0.0-98.rhaos4.8.gitcd80260.el7 RHSA-2021:2437
Red Hat OpenShift 4 stress-ng 0.12.06-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 toolbox 0.0.8-3.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 3 jenkins 2.289.1.1624365627-1.el7 RHSA-2021:2517
Red Hat OpenShift 3 jenkins-2-plugins 3.11.1624366838-1.el7 RHSA-2021:2517

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:config-file-provider < 3.7.1 3.7.1 GHSA-q7xg-hh3q-hc68

Advisories 5

References