This advisory announces a vulnerability in the Git Client Plugin.
SECURITY-445 / CVE-2017-1000242
Temporary files were previously written to the Java temporary directory with default permissions.
A malicious actor with local file access could have captured sensitive information by reading files from that directory.
The temporary files typically are only on the file system for the duration of a single command line
git invocation, but cloning a large Git repo could require an extended time with those sensitive files in the temporary directory.
This change sets permissions on the temporary files to be readable only by the file owner. If a workspace is available, a temporary directory adjacent to the workspace is used instead of the system temporary directory.
As a workaround, setting the system property
java.io.tmpdir on Jenkins master and agents to a directory only accessible by the Jenkins process’s user would prevent this issue.
The Jenkins project would like to thank the reporter for discovering and reporting this vulnerability:
Steven Christou, CloudBees, Inc. for SECURITY-445