Multiple vulnerabilities in Jenkins plugins

[Kevin Guerroudj <kguerroudj () cloudbees com>]

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.

The following releases contain fixes for security vulnerabilities:

* Git client Plugin 6.3.3
* global-build-stats Plugin 347.v32a_eb_0493c4f
* Jakarta Mail API Plugin 2.1.3-3
* OpenTelemetry Plugin 3.1543.1545.vf5a_4ec123769


Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found
here:https://www.jenkins.io/security/advisory/2025-09-03/

We provide advance notification for security updates on this mailing
list:https://groups.google.com/d/forum/jenkinsci-advisories

If you discover security vulnerabilities in Jenkins, please report them as
described here:https://www.jenkins.io/security/#reporting-vulnerabilities

---

SECURITY-3590 / CVE-2025-58458
Git client Plugin 6.3.2 and earlier allows specifying the experimental
`amazon-s3` protocol for use with the bundled JGit library. This protocol
authenticates against Amazon S3 based on contents of the file whose path is
provided as the authority part of the URL
(`amazon-s3://path-to-file@bucketname/folder`).

While use of this protocol in Git client Plugin to perform any actions
always fails due to a bug in the plugin, error messages can be used to
determine whether the specified file path exists on the controller.

This allows attackers to check for the existence of an attacker-specified
file path on the Jenkins controller file system. Whether an attacker has
the permissions to exploit this vulnerability depends on the installed
plugins that expose Git client Plugin functionality to users. For example,
attackers with Credentials/Use Item permission (implied by Item/Configure)
can use form field validation responses of URL fields in Git Plugin.

NOTE: Jenkins instances using command line Git exclusively (the default)
are unaffected by this vulnerability.


SECURITY-3617 / CVE-2025-7962
Jakarta Mail API Plugin 2.1.3-2 and earlier bundles versions of Angus Mail
vulnerable to CVE-2025-7962.

This allows attackers able to control recipient email addresses of emails
sent by Jenkins to send emails with arbitrary contents to arbitrary
recipients.


SECURITY-3535 / CVE-2025-58459
global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform
permission checks in its REST API endpoints.

This allows attackers with Overall/Read permission to enumerate graph IDs.
These IDs can be used to access those graphs.


SECURITY-3602 / CVE-2025-58460
OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier does not perform a
permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an
attacker-specified URL using attacker-specified credentials IDs obtained
through another method, capturing credentials stored in Jenkins.