Skip to content
OpenAdvisories
High RHSA-2016:1206 7 CVEs

Red Hat Security Advisory: jenkins security update

Published Sep 15, 2024 · Updated Jun 27, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · OpenShift 3 openshift:3.1::el7 jenkins 0:1.651.2-1.el7
Red Hat · OpenShift 3 openshift:3.1::el7 jenkins-plugin-openshift-pipeline 0:1.0.12-1.el7
Red Hat · OpenShift 3 openshift:3.2::el7 jenkins 0:1.651.2-1.el7
Red Hat · OpenShift 3 openshift:3.2::el7 jenkins-plugin-openshift-pipeline 0:1.0.12-1.el7

Vulnerabilities 7

  • High 7.4
    CVE-2016-3726

    Jenkins affected by Open Redirect Vulnerability

    Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.5
    CVE-2016-3724

    Jenkins Exposes Sensitive Information from Job Configuration

    Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2016-3721

    Jenkins allows Remote Users to Inject Build Parameters

    Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2016-3722

    Incorrect Authorization in Jenkins Core

    Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2016-3723

    Exposure of Sensitive Information in Jenkins Core

    Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2016-3725

    Missing permissions check in Jenkins Core

    Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions check. NOTE: this issue can be combined with DNS cache poisoning to cause a denial of service (service …

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2016-3727

    Jenkins Exposes Sensitive Information via API URL

    The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1333133
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1335415
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1335416
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1335417
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1335418
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1335420
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1335421
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1335422
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1206.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-3721
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-3721
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-3721
  • article
    https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
  • report
    https://access.redhat.com/security/cve/CVE-2016-3722
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-3722
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-3722
  • report
    https://access.redhat.com/security/cve/CVE-2016-3723
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-3723
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-3723
  • report
    https://access.redhat.com/security/cve/CVE-2016-3724
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-3724
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-3724
  • report
    https://access.redhat.com/security/cve/CVE-2016-3725
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-3725
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-3725
  • report
    https://access.redhat.com/security/cve/CVE-2016-3726
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-3726
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-3726
  • report
    https://access.redhat.com/security/cve/CVE-2016-3727
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-3727
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-3727