Description
Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Mercurial Plugin | unspecified – ≤ 2.16 | 2.15.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins | 2.361.1.1672840472-1.el8 | RHSA-2023:0017 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.8.1672842762-1.el8 | RHSA-2023:0017 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:mercurial | < 2.16.1 | 2.16.1 | GHSA-5786-3qjg-mr88 |
Advisories 2
- RHSA-2023:0017 Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2023-0090 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 15, 2023