Temporary files were previously written to the Java temporary directory with default permissions. A malicious actor with local file access could have captured sensitive information by reading files from that directory. The temporary files typically are only on the file system for the duration of a single command line git invocation, but cloning a large Git repo could require an extended time with those sensitive files in the temporary directory.

This change sets permissions on the temporary files to be readable only by the file owner. If a workspace is available, a temporary directory adjacent to the workspace is used instead of the system temporary directory.

As a workaround, setting the system property java.io.tmpdir on Jenkins master and agents to a directory only accessible by the Jenkins process’s user would prevent this issue.

Affected versions: Git Client Plugin up to and including 2.4.2

External References:

https://jenkins.io/security/advisory/2017-04-27/