Skip to content
OpenAdvisories
Unscored RHSA-2013:0638 7 CVEs

Red Hat Security Advisory: Red Hat OpenShift Enterprise 1.1.2 update

Published Sep 15, 2024 · Updated Jun 28, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · OpenShift 1 openshift:1::el6 jenkins 0:1.502-1.el6op
Red Hat · OpenShift 1 openshift:1::el6 openshift-origin-cartridge-jenkins-1.4 0:1.0.3-1.el6op
Red Hat · OpenShift 1 openshift:1::el6 ruby193-rubygem-rack 1:1.4.1-4.el6
Red Hat · OpenShift 1 openshift:1::el6 rubygem-rack 1:1.3.0-4.el6op

Vulnerabilities 7

  • Medium —
    CVE-2013-0262

    Rack Vulnerable to Path Traversal

    rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remot…

    rack ruby-rack ruby-rack Debian Ubuntu RubyGems
  • Medium —
    CVE-2013-0263

    Rack arbitrary code execution via timing attack

    Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involvin…

    rack ruby-rack ruby-rack Debian Ubuntu RubyGems
  • Medium —
    CVE-2013-0327

    Jenkins Cross-Site Request Forgery vulnerability

    Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-0328

    Jenkins subject to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-0329

    Jenkins Cross-Site Request Forgery vulnerability

    Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-0330

    Jenkins allows Remote Users to Build Arbitrary Jobs

    Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium —
    CVE-2013-0331

    Jenkins Vulnerable to Denial of Service (DoS) via Crafted Payload

    Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.

    org.jenkins-ci.main:jenkins-core Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=909071
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=909072
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=914875
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=914876
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=914877
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=914878
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=914879
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0638.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-0262
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-0262
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-0262
  • report
    https://access.redhat.com/security/cve/CVE-2013-0263
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-0263
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-0263
  • report
    https://access.redhat.com/security/cve/CVE-2013-0327
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-0327
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-0327
  • report
    https://access.redhat.com/security/cve/CVE-2013-0328
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-0328
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-0328
  • report
    https://access.redhat.com/security/cve/CVE-2013-0329
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-0329
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-0329
  • report
    https://access.redhat.com/security/cve/CVE-2013-0330
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-0330
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-0330
  • report
    https://access.redhat.com/security/cve/CVE-2013-0331
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-0331
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-0331