CVE-2021-21670
Fixed in a distro release EPSS 2%
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.
Products: Jenkins project Jenkins
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.289.2 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.300 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | jenkins | 2.300-1 |
| Red Hat openshift 4.6 | jenkins | 0:2.289.2.1629437819-1.el8 |
| Red Hat openshift 4.7 | jenkins | 0:2.289.2.1628252553-1.el8 |
| Red Hat openshift 4.8 | butane | 0:0.12.1-2.rhaos4.8.el8 |
| Red Hat openshift 4.8 | butane-debuginfo | 0:0.12.1-2.rhaos4.8.el8 |
| Red Hat openshift 4.8 | jenkins | 0:2.289.3.1633554819-1.el8 |