CVE-2024-43044
Fixed in a distro release EPSS 29%CVSS 8.8
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.
Products: Jenkins project Jenkins
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.452.4 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.462.1 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.471 |
| Maven | org.jenkins-ci.main:remoting | 3206.3208 |
| Maven | org.jenkins-ci.main:remoting | 3248.3250 |
| Maven | org.jenkins-ci.main:remoting | 3256.3258 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | jenkins | 2.472-r0 |
| Chainguard | jenkins-2.462 | 2.462.3-r8 |
| Chainguard | jenkins-compat | 2.472-r0 |
| Chainguard | jenkins-remoting | 2.472-r0 |
| Red Hat ocp tools 4.12 | jenkins | 0:2.462.1.1723550696-3.el8 |
| Red Hat ocp tools 4.12 | jenkins-2-plugins | 0:4.12.1723550778-1.el8 |
| Red Hat ocp tools 4.13 | jenkins | 0:2.462.1.1723445923-3.el8 |
| Red Hat ocp tools 4.13 | jenkins-2-plugins | 0:4.13.1723446018-1.el8 |
| Red Hat ocp tools 4.14 | jenkins | 0:2.462.1.1723225151-3.el8 |
| Red Hat ocp tools 4.14 | jenkins-2-plugins | 0:4.14.1723225212-1.el8 |
| Red Hat ocp tools 4.15 | jenkins | 0:2.462.1.1723440104-3.el8 |
| Red Hat ocp tools 4.15 | jenkins-2-plugins | 0:4.15.1723440333-1.el8 |
| Wolfi | jenkins | 2.472-r0 |
| Wolfi | jenkins-compat | 2.472-r0 |
| Wolfi | jenkins-remoting | 2.472-r0 |