Bug 1921322 (CVE-2021-21615)

Summary: CVE-2021-21615 jenkins: Filesystem traversal by privileged users
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abenaiss, aileenc, aos-bugs, bmontgom, chazlett, drieden, eparis, ggaughan, gmalinko, janstey, jburrell, jochrist, jokerman, jwon, nstielau, pbhattac, sponnaga, vbobade
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: jenkins 2.276, jenkins LTS 2.263.3 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-02-18 19:02:08 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1921418, 1921419, 1925482, 1925483, 1929921    
Bug Blocks: 1921323    

Description Pedro Sampaio 2021-01-27 21:51:09 UTC
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.


Comment 2 Sam Fowler 2021-01-28 02:40:28 UTC
External References:


Comment 3 errata-xmlrpc 2021-02-17 19:04:42 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2021:0423 https://access.redhat.com/errata/RHSA-2021:0423

Comment 4 Product Security DevOps Team 2021-02-18 19:02:08 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Comment 5 errata-xmlrpc 2021-03-03 04:17:37 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.5

Via RHSA-2021:0429 https://access.redhat.com/errata/RHSA-2021:0429