About recent CVE Issue

Using Jenkins Ask a question
1

hello all,
about this:

i have the 2.452.2 version and i don’t understand if my version is affected or not

thank all

2

Jenkins 2.452.2 already includes that fix. It is not affected by that advisory. The issue report says:

Jenkins 2.442, LTS 2.426.3, and LTS 2.440.1 disables the command parser feature that replaces an @ character followed by a file path in an argument with the file’s contents for CLI commands.

Jenkins 2.452.2 is affected by the critical advisory published 7 Aug 2024

It is also affected by the advisory published 2 Oct 2024

1 Like
3

hi mark,
thank you so much

1 Like