CVE-2024-34146

Name of the Vulnerable Software and Affected Versions Jenkins Git server Plugin versions 114.v068a c7cc2574 and earlier

Description The issue is related to a lack of permission check for read access to a Git repository over SSH. Attackers with a previously configured SSH public key but lacking Overall/Read permission can access these repositories. This allows unauthorized access to Git repositories.

Recommendations For Jenkins Git server Plugin versions 114.v068a c7cc2574 and earlier, update to a version that requires Overall/Read permission to access Git repositories over SSH, such as version 117.veb 68868fa 027. As a temporary workaround, consider restricting SSH access to Git repositories or ensuring that all users with configured SSH public keys have Overall/Read permission.