Description
Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Git Plugin | unspecified – ≤ 4.11.1 | 4.9.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | git | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:git | < 4.11.2 | 4.11.2 | GHSA-84cm-vjwm-m979 |
| Maven | org.jenkins-ci.plugins:mercurial | < 2.16.1 | 2.16.1 | GHSA-84cm-vjwm-m979 |
| Maven | org.jenkins-ci.plugins:repo | < 1.15.0 | 1.15.0 | GHSA-84cm-vjwm-m979 |
Advisories 1
- WID-SEC-2023-0090 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 15, 2023