Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Fixed packages 2

Vulnerabilities 22

• Critical 9.9
  CVE-2022-43402

  Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution

  A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipe…

  Jenkins Project Jenkins Pipeline: Groovy Plugin org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven
  Oct 19, 2022
• Critical 9.9
  CVE-2022-43403

  Jenkins Script Security Plugin sandbox bypass vulnerability

  A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Oct 19, 2022
• Critical 9.8
  CVE-2022-29599

  Commandline class shell injection vulnerabilities

  In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

  Apache Software Foundation Apache Maven org.apache.maven.shared:maven-shared-utils maven-shared-utils Debian Ubuntu Maven
  May 23, 2022
• Critical 9.8
  CVE-2022-42889 Public exploit EPSS 100%

  Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

  Apache Software Foundation Apache Commons Text com.guicedee.services:commons-text commons-text Debian Ubuntu Maven
  Oct 13, 2022
• Critical 9.8
  CVE-2022-45047 Public exploit

  Apache MINA SSHD: Java unsafe deserialization vulnerability

  Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSH…

  Apache Software Foundation Apache MINA SSHD org.apache.sshd:sshd-common org.apache.sshd:sshd-core Maven
  Nov 16, 2022
• Critical 9.1
  CVE-2021-26291 Public exploit

  block repositories using http by default

  Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a posit…

  Apache Software Foundation Apache Maven org.apache.maven:maven-core maven Debian Ubuntu Maven
  Apr 23, 2021
• High 8.8
  CVE-2022-43401

  Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin

  A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pip…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven
  Oct 19, 2022
• High 8.8
  CVE-2022-43404

  Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin

  A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven
  Oct 19, 2022
• High 8.8
  CVE-2022-43405

  Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin and Pipeline: Deprecated Groovy Libraries Plugin

  A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sand…

  Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin org.jenkins-ci.plugins.workflow:workflow-cps-global-lib io.jenkins.plugins:pipeline-groovy-lib Web / CMS Maven
  Oct 19, 2022
• High 8.8
  CVE-2022-43406

  Sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin

  A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypa…

  Jenkins Project Jenkins Pipeline: Deprecated Groovy Libraries Plugin org.jenkins-ci.plugins.workflow:workflow-cps-global-lib io.jenkins.plugins:pipeline-groovy-lib Web / CMS Maven
  Oct 19, 2022
• High 8.8
  CVE-2022-43407

  CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin

  Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that process user interactions for the given 'input' step (proceed or abort) and is n…

  Jenkins Project Jenkins Pipeline: Input Step Plugin org.jenkins-ci.plugins:pipeline-input-step Web / CMS Maven
  Oct 19, 2022
• High 8.8
  CVE-2023-24422 Public exploit

  Sandbox bypass in Jenkins Script Security Plugin

  A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execut…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Jan 24, 2023
• High 8.3
  CVE-2022-1471 Public exploit EPSS 100%

  Remote Code execution in SnakeYAML

  SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 cassandra-reaper Debian Ubuntu Wolfi Maven
  Dec 1, 2022
• High 7.5
  CVE-2022-25857

  Denial of Service (DoS)

  The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

  management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat org.yaml:snakeyaml snakeyaml Debian Ubuntu Wolfi Maven
  Aug 30, 2022
• Medium 6.5
  CVE-2022-43408

  Jenkins Pipeline: Stage View Plugin allows CSRF protection bypass of any target URL in Jenkins

  Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify 'input' step IDs resulting in …

  Jenkins Project Jenkins Pipeline: Stage View Plugin org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view Web / CMS Maven
  Oct 19, 2022
• Medium 5.4
  CVE-2022-43409

  Stored XSS vulnerability in Jenkins Pipeline: Supporting APIs Plugin

  Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able…

  Jenkins Project Jenkins Pipeline: Supporting APIs Plugin org.jenkins-ci.plugins.workflow:workflow-support Web / CMS Maven
  Oct 19, 2022
• Medium 5.4
  CVE-2023-25761

  Cross-site Scripting in Jenkins JUnit Plugin

  Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit re…

  Jenkins Project Jenkins JUnit Plugin org.jenkins-ci.plugins:junit Web / CMS Maven
  Feb 15, 2023
• Medium 5.4
  CVE-2023-25762 EPSS 82%

  Cross-site Scripting in Jenkins Pipeline: Build Step Plugin

  Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

  Jenkins Project Jenkins Pipeline: Build Step Plugin org.jenkins-ci.plugins:pipeline-build-step Web / CMS Maven
  Feb 15, 2023
• Medium 5.3
  CVE-2023-27904

  Information disclosure through error stack traces related to agents

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023
• Medium 4.4
  CVE-2023-27903

  Incorrect Authorization in Jenkins Core

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to …

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023
• Medium 4.3
  CVE-2022-30953

  Cross Site Request Forgery in Jenkins Blue Ocean Plugin

  A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.

  Jenkins Project Jenkins Blue Ocean Plugin io.jenkins.blueocean:blueocean-parent Web / CMS Maven
  May 17, 2022
• Medium 4.3
  CVE-2022-30954

  Missing permission check in Jenkins Blue Ocean Plugin

  Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

  Jenkins Project Jenkins Blue Ocean Plugin io.jenkins.blueocean:blueocean-parent Web / CMS Maven
  May 17, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://docs.openshift.com/container-platform/4.11/cicd/jenkins/important-changes-to-openshift-jenkins-images.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1955739
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066479
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2119646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2119647
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2126789
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135435
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136370
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136374
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136381
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136382
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136383
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136386
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136388
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136391
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2145194
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2164278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170039
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170041
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177634
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3198.json
• report
  https://access.redhat.com/security/cve/CVE-2021-26291
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-26291
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-26291
• article
  https://maven.apache.org/docs/3.8.1/release-notes.html#cve-2021-26291
• report
  https://access.redhat.com/security/cve/CVE-2022-1471
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1471
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1471
• article
  https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
• report
  https://access.redhat.com/security/cve/CVE-2022-25857
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-25857
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-25857
• article
  https://bitbucket.org/snakeyaml/snakeyaml/issues/525
• report
  https://access.redhat.com/security/cve/CVE-2022-29599
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29599