Homepage

Insecure Temporary File The advisory has been revoked - it doesn't affect any version of package jenkins  (opens in a new tab)

Threat Intelligence

EPSS
4.35% (91st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL7-JENKINS-5395010
  • published26 Jul 2021
  • disclosed22 Oct 2020
Report a new vulnerability Found a mistake?

Introduced: 22 Oct 2020

CVE-2020-27216  (opens in a new tab)
CWE-377  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:7.

NVD Description

Note: Versions mentioned in the description apply only to the upstream jenkins package and not the jenkins package as distributed by RHEL.

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

References