Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · OpenShift 4 openshift:4.10::el8 | jenkins-2-plugins | 0:4.10.1681719745-1.el8 |
Vulnerabilities 2
-
Medium 5.4
Cross-site Scripting in Jenkins JUnit Plugin
Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit re…
-
Medium 5.4CVE-2023-25762 EPSS 82%
Cross-site Scripting in Jenkins Pipeline: Build Step Plugin
Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
article
https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2135435
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2170039
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2170041
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1866.json
-
report
https://access.redhat.com/security/cve/CVE-2023-25761
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-25761
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-25761
-
article
https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3032
-
report
https://access.redhat.com/security/cve/CVE-2023-25762
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-25762
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-25762
-
article
https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3019