Description
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | unspecified – ≤ 2.318, unspecified – ≤ LTS 2.303.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | coreos-installer | 0.9.0-8.rhaos4.8.el8 | RHSA-2022:0055, RHSA-2021:4829 |
| Red Hat OpenShift 4 | coreos-installer-bootinfra | 0.12.0-1.rhaos4.10.el8 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | cri-o | 1.23.0-92.rhaos4.10.gitdaab4d1.el7 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | jenkins | 2.303.3.1637595827-1.el8 | RHSA-2022:0055, RHSA-2021:4833, RHSA-2021:4829 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.6.1637602169-1.el8 | RHSA-2022:0055, RHSA-2021:4833, RHSA-2021:4829 |
| Red Hat OpenShift 4 | openshift +1 | 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 | RHSA-2022:0055 |
| Red Hat OpenShift 3 | jenkins | 2.303.3.1637698110-1.el7 | RHSA-2021:4827 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1637699107-1.el7 | RHSA-2021:4827 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.303.3 | 2.303.3 | GHSA-3q84-vrvx-rfvf |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.304, < 2.319 | 2.319 | GHSA-3q84-vrvx-rfvf |
Advisories 6
- RHSA-2022:0055 Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2021:4833 Red Hat Security Advisory: OpenShift Container Platform 4.9.9 security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2021:4827 Red Hat Security Advisory: OpenShift Container Platform 3.11.569 security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2021:4829 Red Hat Security Advisory: OpenShift Container Platform 4.8.22 security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2021:4799 Red Hat Security Advisory: OpenShift Container Platform 4.6.51 packages and security update Red Hat Security Advisories (RHSA) · Aug 12, 2026
- RHSA-2021:4801 Red Hat Security Advisory: OpenShift Container Platform 4.7.38 security update Red Hat Security Advisories (RHSA) · Aug 12, 2026