CVE-2021-21694
Fixed in a distro release EPSS 2%
FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Products: Jenkins project Jenkins
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.303.3 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.319 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 3.11 | jenkins | 0:2.303.3.1637698110-1.el7 |
| Red Hat openshift 3.11 | jenkins-2-plugins | 0:3.11.1637699107-1.el7 |
| Red Hat openshift 4.10 | coreos-installer | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-bootinfra | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-bootinfra-debuginfo | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-debuginfo | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-debugsource | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | cri-o | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
| Red Hat openshift 4.10 | cri-o | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
| Red Hat openshift 4.10 | cri-o-debuginfo | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
| Red Hat openshift 4.10 | cri-o-debuginfo | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
| Red Hat openshift 4.10 | cri-o-debugsource | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
| Red Hat openshift 4.10 | jenkins | 0:2.319.2.1643288987-1.el8 |
| Red Hat openshift 4.10 | jenkins-2-plugins | 0:4.10.1643404185-1.el8 |
| Red Hat openshift 4.10 | openshift | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-clients | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-clients | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift-clients-redistributable | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-clients-redistributable | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift-hyperkube | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift-hyperkube | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
| Red Hat openshift 4.6 | jenkins | 0:2.303.3.1637597493-1.el8 |
| Red Hat openshift 4.6 | jenkins-2-plugins | 0:4.6.1637602169-1.el8 |
| Red Hat openshift 4.7 | jenkins | 0:2.303.3.1637597018-1.el8 |
| Red Hat openshift 4.7 | jenkins-2-plugins | 0:4.7.1637600997-1.el8 |
| Red Hat openshift 4.8 | coreos-installer | 0:0.9.0-8.rhaos4.8.el8 |
| Red Hat openshift 4.8 | jenkins | 0:2.303.3.1637596565-1.el8 |
| Red Hat openshift 4.8 | jenkins-2-plugins | 0:4.8.1637599935-1.el8 |
| Red Hat openshift 4.9 | jenkins | 0:2.303.3.1637595827-1.el8 |
| Red Hat openshift 4.9 | jenkins-2-plugins | 0:4.9.1637598812-1.el8 |