Description
In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | 2.321 – < unspecified, unspecified – ≤ 2.355, LTS 2.332.1 – < unspecified, unspecified – ≤ LTS 2.332.3 | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | jenkins | 2.346.2-r0 | — |
| Alpine v3.23 | jenkins | 2.346.2-r0 | — |
| Alpine v3.22 | jenkins | 2.346.2-r0 | — |
| Alpine v3.21 | jenkins | 2.346.2-r0 | — |
| Alpine v3.20 | jenkins | 2.346.2-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | jenkins | 2.346.2-r0 | — |
| Alpine v3.18 | jenkins | 2.346.2-r0 | — |
| Alpine v3.17 | jenkins | 2.346.2-r0 | — |
| Alpine v3.16 | jenkins | 2.346.2-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.350, < 2.356 | 2.356 | GHSA-7f84-p6r5-jr6q |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.346, < 2.346.1 | 2.346.1 | GHSA-7f84-p6r5-jr6q |
| Maven | org.jenkins-ci.main:jenkins-core | < 2.332.4 | 2.332.4 | GHSA-7f84-p6r5-jr6q |
Advisories 1
- WID-SEC-2022-0445 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 22, 2023