Skip to content
OpenAdvisories
Critical RHSA-2020:4223 4 CVEs

Red Hat Security Advisory: OpenShift Container Platform 3.11.306 jenkins security update

Published Sep 16, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · OpenShift 3 openshift:3.11::el7 jenkins 0:2.235.5.1600415953-1.el7

Vulnerabilities 4

  • Critical 9.4
    CVE-2019-17638 Public exploit EPSS 11%

    Operation on a Resource after Expiration or Release in Jetty Server

    In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the Byte…

    The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Maven
  • High 8.0
    CVE-2020-2229 Public exploit

    Jenkins Cross-Site Scripting vulnerability in help icons

    Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • High 8.0
    CVE-2020-2230 Public exploit EPSS 83%

    Jenkins Cross-site Scripting vulnerability in project naming strategy

    Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • Medium 5.4
    CVE-2020-2231 Public exploit

    Improper Neutralization of Input During Web Page Generation in Jenkins

    Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission…

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1864680
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1874830
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1875232
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1875234
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4223.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-17638
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-17638
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-17638
  • article
    https://bugs.eclipse.org/bugs/show_bug.cgi?id=564984
  • article
    https://www.jenkins.io/security/advisory/2020-08-17/
  • report
    https://access.redhat.com/security/cve/CVE-2020-2229
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-2229
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-2229
  • article
    https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1955
  • report
    https://access.redhat.com/security/cve/CVE-2020-2230
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-2230
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-2230
  • article
    https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1957
  • report
    https://access.redhat.com/security/cve/CVE-2020-2231
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-2231
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-2231
  • article
    https://jenkins.io/security/advisory/2020-08-12/#SECURITY-1960