CVE-2017-1000242: Insecure temporary file usage in Jenkins Git Client Plugin
Summary
CVE-2017-1000242: Insecure temporary file usage in Jenkins Git Client Plugin. Affects org.jenkins-ci.plugins:git-client versions < 2.4.3. Fixed in 2.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Git Client Plugin is a Maven package that provides functionality for interacting with Git repositories within the Jenkins continuous integration and delivery platform. It allows users to clone, fetch, and push changes to Git repositories. The plugin is widely used in software development workflows to automate build and deployment processes.
Vulnerability Detail
The Jenkins Git Client Plugin version 2.4.2 and earlier has a vulnerability that involves the insecure usage of temporary files. When creating temporary files, the plugin sets insecure permissions, which can result in information disclosure. An attacker with local access to the system could exploit this vulnerability to read sensitive information contained in these temporary files. The vulnerability has a CVSS score of 3.3, indicating a low severity level.
How To Fix
Minimum fixed version
2.4.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that the Jenkins server is only accessible to trusted individuals and implementing proper access controls to limit local system access.
Conclusion
The Jenkins Git Client Plugin version 2.4.2 and earlier is vulnerable to insecure temporary file usage, which can result in information disclosure. Users are advised to upgrade to version 2.4.3 or later to fix this vulnerability. It is also recommended to implement proper access controls to limit local system access. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:git-client →
FAQ
The vulnerability allows an attacker with local access to the system to read sensitive information contained in temporary files created by the Jenkins Git Client Plugin.
No, remote exploitation of this vulnerability is not possible as it requires local access to the system.
There are no known instances of this vulnerability being exploited in the wild.
While upgrading to the fixed version is the recommended solution, users can mitigate the risk by ensuring that the Jenkins server is only accessible to trusted individuals and implementing proper access controls to limit local system access.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-fcxw-hhxq-48wx/GHSA-fcxw-hhxq-48wx.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:git-client.
