Description
An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins Pipeline Utility Steps Plugin | ≤ 2.15.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins | 2.401.1.1685677065-1.el8 | RHSA-2023:3625 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.10.1685679861-1.el8 | RHSA-2023:3625 |
| Red Hat Ocp Tools 4 | jenkins | 2.401.1.1686649641-3.el8 | RHSA-2023:3663, RHSA-2023:3610 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.11.1686831822-1.el8 | RHSA-2023:3663, RHSA-2023:3610 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:pipeline-utility-steps | < 2.15.3 | 2.15.3 | GHSA-6987-xccv-fhjp |
Advisories 4
- RHSA-2023:3663 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:3625 Red Hat Security Advisory: OpenShift Container Platform 4.10.62 security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2023:3610 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- WID-SEC-2023-1228 Jenkins Plugins: Mehrere Schwachstellen ermöglichen Manipulation von Dateien BSI CERT-Bund (WID) · Jun 25, 2023
References
- Jenkins Security Advisory 2023-05-16 vendor-advisory