CVE-2024-34146: Jenkins Git server Plugin does not perform a permission check

May 2, 2024 (updated May 3, 2024)

Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH.

This allows attackers with a previously configured SSH public key but lacking Overall/Read permission to access Git repositories.

Git server Plugin 117.veb_68868fa_027 requires Overall/Read permission to access Git repositories over SSH.

References

github.com/advisories/GHSA-xh9c-vcf9-h94m
nvd.nist.gov/vuln/detail/CVE-2024-34146
www.jenkins.io/security/advisory/2024-05-02/

Code Behaviors & Features

Detect and mitigate CVE-2024-34146 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →