Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.
Recommended action: Upgrade to 2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multibranch Pipelines by default limit who can change the Pipeline definition from the Jenkinsfile. This is useful for SCMs like GitHub: Jenkins can build content from users without commit access, but who can submit pull requests, without granting them the ability to modify the Pipeline definition. In that case, Jenkins will just use the Pipeline definition in the pull request’s destination branch instead. In Pipeline: Deprecated Groovy Libraries Plugin 564.ve62a4ebbe039 and earlier the same protection does not apply to uses of the library step with a retriever argument pointing to a library in the current build’s repository and branch (e.g., library(…, retriever: legacySCM(scm))). This allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the library behavior in their pull request, even if the Pipeline is configured to not trust them. Pipeline: Deprecated Groovy…
Recommended action: Upgrade to 566.vd0a (pre-release) or 2.21.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Pipeline: Shared Groovy Libraries Plugin prior to 561.vace0de3c2d69, 2.21.1, and 2.18.1 uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Recommended action: Upgrade to 561.va, 2.21.1 or 2.18.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
561.va_ce0de3c2d692.18.12.21.1· Vendor fix available
Issue
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.
Recommended action: Upgrade to 561.va_ce0de3c2d69, 2.21.1 or 2.18.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
561.va_ce0de3c2d692.18.12.21.1· Vendor fix available
Issue
Jenkins Pipeline: Shared Groovy Libraries Plugin does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
Recommended action: Upgrade to 561.va_ce0de3c2d69, 2.21.1 or 2.18.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Pipeline: Deprecated Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same workspace directory for all checkouts of Pipeline libraries with the same name regardless of the SCM being used and the source of the library configuration. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents, if a global Pipeline library already exists. Pipeline: Deprecated Groovy Libraries Plugin 561.vace0de3c2d69 uses distinct checkout directories per SCM for Pipeline libraries.
Recommended action: Upgrade to 561.va_ce0de3c2d69 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Pipeline: Deprecated Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create directories without canonicalization or sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library names if a global Pipeline library is already configured. Pipeline: Deprecated Groovy Libraries Plugin 561.vace0de3c2d69 sanitizes the names of Pipeline libraries when creating library directories.
Recommended action: Upgrade to 561.va_ce0de3c2d69 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Pipeline: Deprecated Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library names if a global Pipeline library configured to use caching already exists. Pipeline: Deprecated Groovy Libraries Plugin 561.vace0de3c2d69 sanitizes the names of Pipeline libraries when creating library cache directories.
Recommended action: Upgrade to 561.va_ce0de3c2d69 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.