Advisories for Maven/Org.jenkins-Ci.plugins/Git-Server package

Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH. This allows attackers with a previously configured SSH public key but lacking Overall/Read permission to access Git repositories. Git server Plugin 117.veb_68868fa_027 requires Overall/Read permission to access Git repositories over SSH.

Jenkins Git server Plugin uses the args4j library to parse command arguments and options on the Jenkins controller when processing Git commands received via SSH. This command parser has a feature that replaces an @ character followed by a file path in an argument with the file’s contents (expandAtFiles). This feature is enabled by default and Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable it. This allows attackers with …