CVE-2020-2160
Fixed in a distro release EPSS 2%
Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
Products: Jenkins project Jenkins
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.204.6 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.228 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 3.11 | jenkins | 0:2.222.1.1591351669-1.el7 |
| Red Hat openshift 4.3 | atomic-enterprise-service-catalog | 1:4.3.25-202006081518.git.1.52b3a66.el7 |
| Red Hat openshift 4.3 | atomic-enterprise-service-catalog-svcat | 1:4.3.25-202006081518.git.1.52b3a66.el7 |
| Red Hat openshift 4.3 | atomic-openshift-service-idler | 0:4.3.25-202006081518.git.1.79365c5.el7 |
| Red Hat openshift 4.3 | conmon | 2:2.0.17-1.rhaos4.3.el7 |
| Red Hat openshift 4.3 | conmon | 2:2.0.17-1.rhaos4.3.el8 |
| Red Hat openshift 4.3 | cri-o | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7 |
| Red Hat openshift 4.3 | cri-o | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 |
| Red Hat openshift 4.3 | cri-o-debuginfo | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el7 |
| Red Hat openshift 4.3 | cri-o-debuginfo | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 |
| Red Hat openshift 4.3 | cri-o-debugsource | 0:1.16.6-15.dev.rhaos4.3.gitebc053b.el8 |
| Red Hat openshift 4.3 | jenkins | 0:2.222.1.1591349991-1.el7 |
| Red Hat openshift 4.3 | machine-config-daemon | 0:4.3.25-202006081518.git.1.478b31a.el8 |
| Red Hat openshift 4.3 | openshift | 0:4.3.25-202006060952.git.1.96c30f6.el7 |
| Red Hat openshift 4.3 | openshift | 0:4.3.25-202006060952.git.1.96c30f6.el8 |
| Red Hat openshift 4.3 | openshift-ansible | 0:4.3.25-202006060952.git.1.1253fde.el7 |
| Red Hat openshift 4.3 | openshift-ansible-test | 0:4.3.25-202006060952.git.1.1253fde.el7 |
| Red Hat openshift 4.3 | openshift-clients | 0:4.3.25-202006060952.git.1.fd93102.el7 |
| Red Hat openshift 4.3 | openshift-clients | 0:4.3.25-202006060952.git.1.fd93102.el8 |
| Red Hat openshift 4.3 | openshift-clients-redistributable | 0:4.3.25-202006060952.git.1.fd93102.el7 |
| Red Hat openshift 4.3 | openshift-clients-redistributable | 0:4.3.25-202006060952.git.1.fd93102.el8 |
| Red Hat openshift 4.3 | openshift-hyperkube | 0:4.3.25-202006060952.git.1.96c30f6.el7 |
| Red Hat openshift 4.3 | openshift-hyperkube | 0:4.3.25-202006060952.git.1.96c30f6.el8 |
| Red Hat openshift 4.3 | openshift-kuryr | 0:4.3.25-202006081518.git.1.240b401.el8 |
| Red Hat openshift 4.3 | openshift-kuryr-cni | 0:4.3.25-202006081518.git.1.240b401.el8 |
| Red Hat openshift 4.3 | openshift-kuryr-common | 0:4.3.25-202006081518.git.1.240b401.el8 |
| Red Hat openshift 4.3 | openshift-kuryr-controller | 0:4.3.25-202006081518.git.1.240b401.el8 |
| Red Hat openshift 4.3 | python3-kuryr-kubernetes | 0:4.3.25-202006081518.git.1.240b401.el8 |
| Red Hat openshift 4.3 | s390utils | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-base | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-base-debuginfo | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-cmsfs | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-cmsfs-debuginfo | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-cmsfs-fuse | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-cmsfs-fuse-debuginfo | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-cpacfstatsd | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-cpacfstatsd-debuginfo | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-cpuplugd | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-cpuplugd-debuginfo | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-debuginfo | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-debugsource | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-devel | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-hmcdrvfs | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-hmcdrvfs-debuginfo | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-iucvterm | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-iucvterm-debuginfo | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-mon_statd | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-mon_statd-debuginfo | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-osasnmpd | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-osasnmpd-debuginfo | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-zdsfs | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-zdsfs-debuginfo | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-ziomon | 2:2.6.0-23.el8 |
| Red Hat openshift 4.3 | s390utils-ziomon-debuginfo | 2:2.6.0-23.el8 |
| Red Hat openshift 4.4 | atomic-enterprise-service-catalog | 1:4.4.0-202006080017.git.1.77a5cc9.el7 |
| Red Hat openshift 4.4 | atomic-enterprise-service-catalog-svcat | 1:4.4.0-202006080017.git.1.77a5cc9.el7 |
| Red Hat openshift 4.4 | atomic-openshift-service-idler | 0:4.4.0-202006080017.git.1.7e463c3.el7 |
| Red Hat openshift 4.4 | conmon | 2:2.0.17-1.rhaos4.4.el7 |
| Red Hat openshift 4.4 | conmon | 2:2.0.17-1.rhaos4.4.el8 |
| Red Hat openshift 4.4 | cri-o | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7 |
| Red Hat openshift 4.4 | cri-o | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 |
| Red Hat openshift 4.4 | cri-o-debuginfo | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el7 |
| Red Hat openshift 4.4 | cri-o-debuginfo | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 |
| Red Hat openshift 4.4 | cri-o-debugsource | 0:1.17.4-14.dev.rhaos4.4.gitb93af5d.el8 |
| Red Hat openshift 4.4 | jenkins | 0:2.222.1.1591351066-1.el7 |
| Red Hat openshift 4.4 | machine-config-daemon | 0:4.4.0-202006080017.git.1.32e0736.el8 |
| Red Hat openshift 4.4 | openshift | 0:4.4.0-202006061254.git.1.dc84fb4.el8 |
| Red Hat openshift 4.4 | openshift | 0:4.4.0-202006061254.git.1.dc84fb4.el7 |
| Red Hat openshift 4.4 | openshift-ansible | 0:4.4.0-202006061254.git.1.a996454.el7 |
| Red Hat openshift 4.4 | openshift-ansible-test | 0:4.4.0-202006061254.git.1.a996454.el7 |
| Red Hat openshift 4.4 | openshift-clients | 0:4.4.0-202006061254.git.1.26cb6dc.el8 |
| Red Hat openshift 4.4 | openshift-clients | 0:4.4.0-202006061254.git.1.26cb6dc.el7 |
| Red Hat openshift 4.4 | openshift-clients-redistributable | 0:4.4.0-202006061254.git.1.26cb6dc.el7 |
| Red Hat openshift 4.4 | openshift-clients-redistributable | 0:4.4.0-202006061254.git.1.26cb6dc.el8 |
| Red Hat openshift 4.4 | openshift-hyperkube | 0:4.4.0-202006061254.git.1.dc84fb4.el8 |
| Red Hat openshift 4.4 | openshift-hyperkube | 0:4.4.0-202006061254.git.1.dc84fb4.el7 |
| Red Hat openshift 4.4 | openshift-kuryr | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
| Red Hat openshift 4.4 | openshift-kuryr-cni | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
| Red Hat openshift 4.4 | openshift-kuryr-common | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
| Red Hat openshift 4.4 | openshift-kuryr-controller | 0:4.4.0-202006080017.git.1.855ef1d.el8 |
| Red Hat openshift 4.4 | python3-kuryr-kubernetes | 0:4.4.0-202006080017.git.1.855ef1d.el8 |