Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Support Core Plugin defines the permission Support/DownloadBundle that allows users without Overall/Administer permission to create and download support bundles containing a limited set of diagnostic information. Support Core Plugin 1206.v14049fabd860 and earlier does not correctly perform permission checks in several HTTP endpoints. This allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information limited to users with Overall/Administer permission. Support Core Plugin 1206.1208.v9b7a1d48db0f deprecates the Support/DownloadBundle permission. The Overall/Administer permission is now required to download support bundles.
Recommended action: Upgrade to 1206.1208.v9b_7a_1d48db_0f or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the \"About user (basic authentication details only)\" information (user.md). In some configurations, this can include the session ID of the user creating the support bundle. Attackers with access to support bundle content and the Jenkins instance could use this information to impersonate the user who created the support bundle. Support Core Plugin 2.72.1 no longer provides the serialized user authentication as part of the \"About user (basic authentication details only)\" information. As a workaround, deselecting \"About user (basic authentication details only)\" before creating a support bundle will exclude the affected information from the bundle.
Recommended action: Upgrade to 2.72.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Support Core Plugin did not validate the paths submitted for the "Delete Support Bundles" feature. This allowed users to delete arbitrary files on the Jenkins controller file system accessible to the OS user account running Jenkins. Additionally, this endpoint did not perform a permission check, allowing users with Overall/Read permission to delete support bundles, and any arbitrary other file, with a known name/path. Support Core Plugin now only allows the deletion of support bundles and related files listed on the UI through this feature. It also ensures that only users with "Download Bundle" permission are able to delete support bundles.
Recommended action: Upgrade to 2.64 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles.
Recommended action: Upgrade to 2.64 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. Support Core Plugin 2.79.1 adds a list of keywords whose associated values are redacted.
Recommended action: Upgrade to 2.79.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.