VulnerableCode Package Details - pkg:alpm/archlinux/jenkins@2.314-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-3bxq-vmjj-kqfe Aliases: CVE-2014-3577 GHSA-cfh5-3ghh-wfjx	org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.	2.315-1 Affected by 0 other vulnerabilities.
VCID-4m6t-zty2-b3d6 Aliases: CVE-2021-21682 GHSA-6q4g-84f3-mw74	Improper Encoding or Escaping of Output Jenkins accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows.	There are no reported fixed by versions.
VCID-tdb7-6gx7-1ucr Aliases: CVE-2021-21683 GHSA-4pw5-r58h-fv24	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') The file browser in Jenkins may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-3bxq-vmjj-kqfe
Aliases:
CVE-2014-3577
GHSA-cfh5-3ghh-wfjx

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

2.315-1
Affected by 0 other vulnerabilities.

VCID-4m6t-zty2-b3d6
Aliases:
CVE-2021-21682
GHSA-6q4g-84f3-mw74

Improper Encoding or Escaping of Output Jenkins accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows.

There are no reported fixed by versions.

VCID-tdb7-6gx7-1ucr
Aliases:
CVE-2021-21683
GHSA-4pw5-r58h-fv24

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') The file browser in Jenkins may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files.

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T18:26:33.819483+00:00	Arch Linux Importer	Affected by	VCID-4m6t-zty2-b3d6	https://security.archlinux.org/AVG-2449	38.0.0
2026-04-01T18:26:33.800385+00:00	Arch Linux Importer	Affected by	VCID-tdb7-6gx7-1ucr	https://security.archlinux.org/AVG-2449	38.0.0
2026-04-01T18:26:33.019712+00:00	Arch Linux Importer	Affected by	VCID-3bxq-vmjj-kqfe	https://security.archlinux.org/AVG-2448	38.0.0