Bug 2260183 (CVE-2024-23899)

Summary:	CVE-2024-23899 jenkins-2-plugins: git-server plugin arbitrary file read vulnerability
Product:	[Other] Security Response	Reporter:	Zack Miele <zmiele>
Component:	vulnerability	Assignee:	Sayan Biswas <sabiswas>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	asatyam, dfreiber, diagrawa, jburrell, rogbas, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	git-server 99.101.v720e86326c09	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Git Server Plugin for Jenkins. This issue could allow an attacker to read the first two lines of arbitrary files on the server's file system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2260178

Description Zack Miele 2024-01-24 20:34:05 UTC

Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins controller file system.

http://www.openwall.com/lists/oss-security/2024/01/24/6
https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3319

Comment 6 errata-xmlrpc 2024-06-05 14:43:54 UTC

This issue has been addressed in the following products:

  OCP-Tools-4.13-RHEL-8

Via RHSA-2024:3636 https://access.redhat.com/errata/RHSA-2024:3636

Comment 7 errata-xmlrpc 2024-06-05 14:44:26 UTC

This issue has been addressed in the following products:

  OCP-Tools-4.14-RHEL-8

Via RHSA-2024:3634 https://access.redhat.com/errata/RHSA-2024:3634

Comment 8 errata-xmlrpc 2024-06-05 14:44:58 UTC

This issue has been addressed in the following products:

  OCP-Tools-4.12-RHEL-8

Via RHSA-2024:3635 https://access.redhat.com/errata/RHSA-2024:3635

Comment 9 errata-xmlrpc 2024-07-17 18:46:58 UTC

This issue has been addressed in the following products:

  OCP-Tools-4.15-RHEL-8

Via RHSA-2024:4597 https://access.redhat.com/errata/RHSA-2024:4597