Agent-to-controller access control allowed writing to sensitive directory used by Pipeline: Shared Groovy Libraries Plugin

🗓️ 04 Nov 2021 00:00:00Reported by Jenkins Security TeamType

Older Jenkins allowed agent access to libraries directory in build dirs, enabling library tampering; upgrade to 2.319 or 2.303.3.

Reporter	Title	Published	Views	Family All 49
FreeBSD	jenkins -- multiple vulnerabilities	4 Nov 202100:00	–	freebsd
AlpineLinux	CVE-2021-21696	4 Nov 202117:15	–	alpinelinux
ArchLinux	[ASA-202111-1] jenkins: multiple issues	5 Nov 202100:00	–	archlinux
BDU FSTEC	The vulnerability of the FilePath API implementation in the Jenkins automation server allows a hacker to execute arbitrary code.	1 Dec 202100:00	–	bdu_fstec
Circl	CVE-2021-21696	4 Nov 202119:25	–	circl
Tenable Nessus	Jenkins Enterprise and Operations Center < 2.277.43.0.2 / 2.303.3.3 Multiple Vulnerabilities (CloudBees Security Advisory 2021-11-04)	19 Nov 202100:00	–	nessus
Tenable Nessus	FreeBSD : jenkins -- multiple vulnerabilities (2bf56269-90f8-4a82-b82f-c0e289f2a0dc)	5 Nov 202100:00	–	nessus
Tenable Nessus	Jenkins LTS < 2.303.3 / Jenkins weekly < 2.319 Multiple Vulnerabilities	4 Nov 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.6.51 (RHSA-2021:4799)	3 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.7.38 (RHSA-2021:4801)	2 Dec 202100:00	–	nessus