GHSA-8xjp-rp29-v5j8
Agent-to-controller security bypass in Jenkins Debian Package Builder Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | ru.yandex.jenkins.plugins.debuilder:debian-package-builder | <= 1.6.11 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agent processes to invoke command-line git at an attacker-specified path on the controller.
This allows attackers able to control agent processes to invoke arbitrary OS commands on the controller.
References
External links from the advisory. They lead to third-party sites.