CVE-2021-21698: Path Traversal
Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
Other sources
Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system
Reference:
https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2506
— Red Hat
Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.
Subversion Plugin 2.15.1 checks for the presence of and prohibits directory separator characters as part of the file name, restricting it to the intended directory.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-21698?
CVE-2021-21698 is a vulnerability in the Jenkins Subversion Plugin that allows file name restriction bypass when looking up a subversion key file on the controller from an agent.
How severe is CVE-2021-21698?
CVE-2021-21698 has a severity rating of 7.5 (high).
Which software versions are affected by CVE-2021-21698?
Jenkins Subversion Plugin versions up to and including 2.15.0 are affected by CVE-2021-21698.
How can I fix CVE-2021-21698?
To fix CVE-2021-21698, upgrade to Jenkins Subversion Plugin version 2.15.1 or later.
Where can I find more information about CVE-2021-21698?
You can find more information about CVE-2021-21698 at the following references: [1](http://www.openwall.com/lists/oss-security/2021/11/04/3), [2](https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2506), [3](https://access.redhat.com/errata/RHSA-2021:4833).