Description
Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | unspecified – ≤ 2.314, unspecified – ≤ LTS 2.303.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.304, < 2.315 | 2.315 | GHSA-6q4g-84f3-mw74 |
| Maven | org.jenkins-ci.main:jenkins-core | < 2.303.2 | 2.303.2 | GHSA-6q4g-84f3-mw74 |
Advisories 1
- WID-SEC-2023-0432 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 20, 2023