Patchwire CVEs, their patch status, and feeds to follow them

CVE-2021-21615

Fixed in a distro release EPSS <1%

Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.

Published 2021-01-26 · CVE record · OSV

Products: Jenkins project Jenkins

Fixed upstream

EcosystemPackageFixed in
Mavenorg.jenkins-ci.main:jenkins-core2.263.3
Mavenorg.jenkins-ci.main:jenkins-core2.276

Distro releases

ReleasePackageFixed in
Arch Linuxjenkins2.276-1
Red Hat openshift 4.5conmon2:2.0.21-1.rhaos4.5.el8
Red Hat openshift 4.5conmon2:2.0.21-1.rhaos4.5.el7
Red Hat openshift 4.5jenkins0:2.263.3.1612434332-1.el7
Red Hat openshift 4.5machine-config-daemon0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8
Red Hat openshift 4.5openshift0:4.5.0-202102050524.p0.git.0.9229406.el8
Red Hat openshift 4.5openshift0:4.5.0-202102050524.p0.git.0.9229406.el7
Red Hat openshift 4.5openshift-ansible0:4.5.0-202102031005.p0.git.0.c6839a2.el7
Red Hat openshift 4.5openshift-ansible-test0:4.5.0-202102031005.p0.git.0.c6839a2.el7
Red Hat openshift 4.5openshift-clients0:4.5.0-202102051529.p0.git.3612.61b096a.el8
Red Hat openshift 4.5openshift-clients0:4.5.0-202102051529.p0.git.3612.61b096a.el7
Red Hat openshift 4.5openshift-clients-redistributable0:4.5.0-202102051529.p0.git.3612.61b096a.el7
Red Hat openshift 4.5openshift-clients-redistributable0:4.5.0-202102051529.p0.git.3612.61b096a.el8
Red Hat openshift 4.5openshift-hyperkube0:4.5.0-202102050524.p0.git.0.9229406.el8
Red Hat openshift 4.5openshift-hyperkube0:4.5.0-202102050524.p0.git.0.9229406.el7
Red Hat openshift 4.5runc0:1.0.0-72.rhaos4.5.giteadfc6b.el8
Red Hat openshift 4.5runc-debuginfo0:1.0.0-72.rhaos4.5.giteadfc6b.el8
Red Hat openshift 4.5runc-debugsource0:1.0.0-72.rhaos4.5.giteadfc6b.el8
Red Hat openshift 4.6jenkins0:2.263.3.1612434510-1.el8