{"id":"CVE-2021-21698","aliases":["AZL-113075","EUVD-2022-4893","GHSA-q58j-fhj7-j6fg","RHSA-2021:4799","RHSA-2021:4801","RHSA-2021:4827","RHSA-2021:4829","RHSA-2021:4833","RHSA-2022:0055"],"status":"published","title":"Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files","description":"Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02142,"percentile":0.82293,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2021-11-04T16:30:44Z","modified":"2026-11-10T14:17:36Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:subversion","fixed_in":["2.15.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.15.0"},{"fixed":"2.15.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.14.3-3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.1"}]}],"versions":["1.24","1.25","1.26","1.28","1.29","1.30","1.31","1.32","1.33","1.34","1.35","1.36","1.37","1.38","1.39","1.40","1.41","1.42","1.43","1.44","1.45","1.48","1.50","1.51","1.53","1.54","2.0","2.0-alpha-1","2.0-beta-1","2.1","2.10","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.11.0","2.11.1","2.12.0","2.12.1","2.12.2","2.13.0","2.13.1","2.13.2","2.14.0","2.14.1","2.14.2","2.14.3","2.14.4","2.14.5","2.15.0","2.2","2.3","2.4","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.5","2.5-beta-1","2.5-beta-2","2.5-beta-3","2.5-beta-4","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.6","2.7.1","2.7.1.1","2.7.2","2.8","2.9"]},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.303.3.1637597493-1.el8"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.1637602169-1.el8"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.303.3.1637597018-1.el8"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.1637600997-1.el8"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.303.3.1637698110-1.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.1637699107-1.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"coreos-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-8.rhaos4.8.el8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.303.3.1637596565-1.el8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.1637599935-1.el8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.303.3.1637595827-1.el8"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.1637598812-1.el8"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.319.2.1643288987-1.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-bootinfra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-bootinfra-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.1643404185-1.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-92.rhaos4.10.gitdaab4d1.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-92.rhaos4.10.gitdaab4d1.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.1-9.rhaos4.10.gitbdffb9a.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.1-9.rhaos4.10.gitbdffb9a.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.1-9.rhaos4.10.gitbdffb9a.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8"}]}],"bundled":24}],"products":[{"vendor":"jenkins","product":"subversion"},{"vendor":"jenkins project","product":"jenkins subversion plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2506","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2021/11/04/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21698","tags":["web","advisory"]},{"url":"https://github.com/jenkinsci/subversion-plugin/commit/7d1525edea6641a2febd3f7deeac55c0a89b0d7e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q58j-fhj7-j6fg"},{"url":"https://github.com/jenkinsci/subversion-plugin","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4799","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020327","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020341","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020343","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020345","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020385","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4799.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21685","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21685","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21686","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21686","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21687","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21687","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21687","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21688","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21688","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21688","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21689","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21689","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21690","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21690","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21691","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21691","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21693","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21693","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21694","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21694","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21694","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21695","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21695","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21695","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21696","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21696","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2423","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21697","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21697","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2428","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21698","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21698","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4801","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4801.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4827","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1920894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2002671","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2002909","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2003491","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2016467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026193","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4827.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4829","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2018478","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4829.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3917","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3917","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3917","tags":["advisory"]},{"url":"https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0c","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4833","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4833.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0055","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051730","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0055.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3577","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-20319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20319","tags":["advisory"]},{"url":"https://github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21684","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2499","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41190","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41190","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41190","tags":["advisory"]},{"url":"https://github.com/moby/moby/security/advisories/GHSA-xmmx-7jpf-fx42","tags":["article"]},{"url":"https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m","tags":["article"]},{"url":"https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41772","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/0fM21h43arc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44716","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44716","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/hcmEScgc00k","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44717","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0532","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0532","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0532","tags":["advisory"]},{"url":"https://github.com/cri-o/cri-o/security/advisories/GHSA-w2j5-3rcx-vx7x","tags":["article"]},{"url":"https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-20612","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-20612","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20612","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2558","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-20617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-20617","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20617","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-1878","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2021-21698","description":"Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.","status":"published","published":"2021-11-04T16:30:44Z","modified":"2024-08-03T18:23:27.475Z","updated_at":"2026-11-02T14:33:00.488332Z"}],"euvd":[{"id":"EUVD-2022-4893","description":"Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.","status":"published","published":"2021-11-04T16:30:44Z","modified":"2024-08-03T18:23:27Z","updated_at":"2026-11-03T03:25:05.131984Z"}],"ghsa":[{"id":"GHSA-q58j-fhj7-j6fg","title":"Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files","description":"Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.\n\nThis allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.\n\nSubversion Plugin 2.15.1 checks for the presence of and prohibits directory separator characters as part of the file name, restricting it to the intended directory.","status":"published","published":"2022-05-24T19:19:43Z","modified":"2023-12-18T11:19:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:26.727664Z"}],"nvd":[{"id":"CVE-2021-21698","description":"Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.","status":"published","published":"2021-11-04T17:15:08.987Z","modified":"2026-06-17T03:36:01.03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:00.549994Z"}],"osv":[{"id":"AZL-113075","title":"CVE-2021-21698 affecting package subversion 1.14.3-3","description":"Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.","status":"published","published":"2021-11-04T17:15:08Z","modified":"2026-11-10T14:17:36.014132331Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-10T15:02:19.085067Z"},{"id":"CVE-2021-21698","description":"Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.","status":"published","published":"2021-11-04T17:15:08.987Z","modified":"2026-10-24T10:30:56.112010208Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"GHSA-q58j-fhj7-j6fg","title":"Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files","description":"Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.\n\nThis allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.\n\nSubversion Plugin 2.15.1 checks for the presence of and prohibits directory separator characters as part of the file name, restricting it to the intended directory.","status":"published","published":"2022-05-24T19:19:43Z","modified":"2024-02-16T08:20:52.779884Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"RHSA-2021:4799","title":"Red Hat Security Advisory: OpenShift Container Platform 4.6.51 packages and security update","status":"published","published":"2024-09-16T06:53:54Z","modified":"2026-08-12T10:01:42Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2021:4801","title":"Red Hat Security Advisory: OpenShift Container Platform 4.7.38 security update","status":"published","published":"2024-09-16T06:53:48Z","modified":"2026-08-12T10:01:42Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2021:4827","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11.569 security update","status":"published","published":"2024-09-16T06:54:02Z","modified":"2026-08-12T10:01:43Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2021:4829","title":"Red Hat Security Advisory: OpenShift Container Platform 4.8.22 security update","status":"published","published":"2024-09-16T06:53:41Z","modified":"2026-08-12T10:01:43Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2021:4833","title":"Red Hat Security Advisory: OpenShift Container Platform 4.9.9 security update","status":"published","published":"2024-09-16T06:53:34Z","modified":"2026-08-12T10:01:44Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0055","title":"Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update","status":"published","published":"2024-09-30T14:19:01Z","modified":"2026-08-20T10:02:39Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"}]}}