CVE-2021-21697 - log back

CVE-2021-21697 edited at 04 Nov 2021 14:44:12
Severity
- Unknown
+ High
Remote
- Unknown
+ Remote
Type
- Unknown
+ Arbitrary filesystem access
Description
+ Agents are allowed some limited access to files on the Jenkins controller file system. The directories agents are allowed to access in Jenkins before 2.319 include the directories storing build-related information, intended to allow agents to store build-related metadata during build execution. As a consequence, this allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions (build.xml and some Pipeline-related metadata).
+
+ Jenkins 2.319 prevents agents from accessing contents of build directories unless it’s for builds currently running on the agent attempting to access the directory.
References
+ https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2428
Notes
CVE-2021-21697 created at 04 Nov 2021 14:30:58