Skip to content
OpenAdvisories
Critical RHSA-2016:0711 5 CVEs

Red Hat Security Advisory: jenkins security update

Published Sep 15, 2024 · Updated Jun 27, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · OpenShift 3 openshift:3.1::el7 jenkins 0:1.642.2-1.el7
Red Hat · OpenShift 3 openshift:3.1::el7 jenkins-plugin-credentials 0:1.24-2.el7
Red Hat · OpenShift 3 openshift:3.1::el7 jenkins-plugin-durable-task 0:1.7-1.el7
Red Hat · OpenShift 3 openshift:3.1::el7 jenkins-plugin-kubernetes 0:0.5-1.el7
Red Hat · OpenShift 3 openshift:3.1::el7 jenkins-plugin-openshift-pipeline 0:1.0.9-1.el7

Vulnerabilities 5

  • Critical 9.8
    CVE-2016-0788 EPSS 12%

    Jenkins allows Execution of Code by Opening a JRMP Listener

    The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.

    org.jenkins-ci.main:jenkins-core Maven
  • Critical 9.8
    CVE-2016-0791

    Exposure of Sensitive Information in Jenkins Core

    Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.8
    CVE-2016-0792 Public exploit EPSS 83%

    Jenkins allows Deserialization of Untrusted Data via an XML File

    Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.1
    CVE-2016-0789

    Jenkins has CRLF Injection Vulnerability in the CLI

    CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.3
    CVE-2016-0790

    Exposure of Sensitive Information in Jenkins Core

    Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.

    org.jenkins-ci.main:jenkins-core Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24
  • article
    https://jenkins.io/changelog-stable/#v1.642.2
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311946
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311947
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311948
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311949
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311950
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1324664
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0711.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-0788
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0788
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0788
  • report
    https://access.redhat.com/security/cve/CVE-2016-0789
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0789
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0789
  • report
    https://access.redhat.com/security/cve/CVE-2016-0790
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0790
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0790
  • report
    https://access.redhat.com/security/cve/CVE-2016-0791
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0791
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0791
  • report
    https://access.redhat.com/security/cve/CVE-2016-0792
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-0792
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-0792