8.8
Élevée
CVE-2026-33001 Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar…
Description
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| OpenShift Developer Tools and Services 4.12 1776764096 | premières → < 1776764096 | 1776764096 |
| OpenShift Developer Tools and Services 4.13 1776764096 | premières → < 1776764096 | 1776764096 |
| OpenShift Developer Tools and Services 4.14 1776762347 | premières → < 1776762347 | 1776762347 |
| OpenShift Developer Tools and Services 4.15 1776762347 | premières → < 1776762347 | 1776762347 |
| OpenShift Developer Tools and Services 4.16 1776944215 | premières → < 1776944215 | 1776944215 |
| OpenShift Developer Tools and Services 4.17 1776944215 | premières → < 1776944215 | 1776944215 |
| OpenShift Developer Tools and Services 4.18 1776944215 | premières → < 1776944215 | 1776944215 |
| OpenShift Developer Tools and Services 4.19 1776944215 | premières → < 1776944215 | 1776944215 |
| OpenShift Developer Tools and Services 4.21 1776944215 | premières → < 1776944215 | 1776944215 |
Afficher les 5 autres branches Masquer les 5 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| OpenShift Developer Tools and Services 4.2 1776944215 | premières → < 1776944215 | 1776944215 |
| Red Hat Developer Hub | Versions non publiées | |
| Jenkins 2.555 | premières → < 2.555 | 2.555 |
| Jenkins 2.541 | premières → < 2.541.3 | 2.541.3 |
| OpenShift Developer Tools and Services 4.20 1776944215 | premières → < 1776944215 | 1776944215 |
Références
- Jenkins Security Advisory 2026-03-18 www.jenkins.io
Chronologie
- Publiée
- Dernière modification
Autres CVE de OpenShift Developer Tools and Services 4.12
Les 12 CVE de OpenShift Developer Tools and Services 4.12 →
CVE-2026-57281
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations…
7.5
Élevée
CVE-2026-53437
Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately…
4.3
Moyenne
CVE-2026-53435
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize…
8.8
Élevée
CVE-2026-40542
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept…
Non notée