Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into the SSH wrapper script generated by the "Manually provided keys" Git Host Key Verification strategy on Unix agents. This allows attackers able to control the name of a build’s working directory (e.g. through a build parameter that determines the workspace directory) to inject shell command substitution and execute arbitrary commands on the agent. This vulnerability only has an impact when attackers can control working directories (e.g., the argument to the dir(…) Pipeline step) while not being able to control the Pipeline itself or the programs or build scripts it executes. This vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission. Git client Plugin 6.6.1 stores the knownhosts file used by the "Manually provided keys" Git Host Key Verification strategy in the system temporary directory, so the workspace…
Recommended action: Upgrade to 6.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.
Recommended action: Upgrade to 6.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Jenkins Git client Plugin 6.3.2 and earlier, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying amazon-s3 protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Recommended action: Upgrade to 6.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Git client plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Git client Plugin 3.11.1 provides strategies for performing host key verification for administrators to select the one that meets their security needs. For more information see the plugin documentation.
Recommended action: Upgrade to 3.11.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Git Client Plugin 2.8.4 and earlier did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.
Recommended action: Upgrade to 2.8.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure
Recommended action: Upgrade to 2.4.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.