Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Fixed packages 2

Vulnerabilities 16

• Critical 9.8
  CVE-2022-22978 Public exploit EPSS 12%

  Authorization bypass in Spring Security

  In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression …

  libspring-java org.springframework.security:spring-security-core org.springframework.security:spring-security-web Ubuntu Maven
  May 19, 2022
• Critical 9.8
  CVE-2022-42889 Public exploit EPSS 100%

  Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

  Apache Software Foundation Apache Commons Text com.guicedee.services:commons-text commons-text Debian Ubuntu Maven
  Oct 13, 2022
• High 8.8
  CVE-2023-24422 Public exploit

  Sandbox bypass in Jenkins Script Security Plugin

  A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execut…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Jan 24, 2023
• High 7.7
  CVE-2022-25647 EPSS 12%

  Deserialization of Untrusted Data

  The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

  openjdk11 openjdk17 trino openjdk15 Debian Ubuntu Alpine Wolfi Maven
  May 1, 2022
• High 7.5
  CVE-2021-46877

  jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode

  jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Mar 18, 2023
• High 7.5
  CVE-2023-24998 Public exploit EPSS 49%

  Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

  Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…

  Apache Software Foundation Apache Tomcat Apache Commons FileUpload tomcat9 Debian Ubuntu Maven
  Feb 20, 2023
• High 7.5
  CVE-2023-27900

  Denial of service in Jenkins Core

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to …

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023
• High 7.5
  CVE-2023-27901

  Denial of service in Jenkins Core

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trig…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023
• High 7.4
  CVE-2020-7692

  Improper Authorization

  PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization requ…

  google-oauth-client-java google-oauth-client-java com.google.oauth-client:google-oauth-client Debian Ubuntu Maven
  Jul 9, 2020
• Medium 6.7
  CVE-2021-4178 Public exploit

  fabric8 kubernetes-client vulnerable

  A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.

  io.fabric8:kubernetes-client Maven
  Aug 24, 2022
• Medium 6.5
  CVE-2022-40151

  Stack Buffer Overflow in xstream

  Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial o…

  x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  Sep 16, 2022
• Medium 6.5
  CVE-2022-40152 EPSS 18%

  Stack Buffer Overflow in Woodstox

  Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effec…

  x-stream Woodstox libxstream-java sonarqube-10 Debian Ubuntu Wolfi Maven
  Sep 16, 2022
• Medium 5.4
  CVE-2023-25761

  Cross-site Scripting in Jenkins JUnit Plugin

  Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit re…

  Jenkins Project Jenkins JUnit Plugin org.jenkins-ci.plugins:junit Web / CMS Maven
  Feb 15, 2023
• Medium 5.4
  CVE-2023-25762 EPSS 82%

  Cross-site Scripting in Jenkins Pipeline: Build Step Plugin

  Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

  Jenkins Project Jenkins Pipeline: Build Step Plugin org.jenkins-ci.plugins:pipeline-build-step Web / CMS Maven
  Feb 15, 2023
• Medium 5.3
  CVE-2023-27904

  Information disclosure through error stack traces related to agents

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023
• Medium 4.3
  CVE-2023-27902

  Incorrect Permission Preservation in Jenkins Core

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their contents.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1856376
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2034388
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2087606
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134291
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134292
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135435
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2164278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170039
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170041
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2172298
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177630
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177638
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2185707
• article
  https://issues.redhat.com/browse/PITEAM-10
• article
  https://issues.redhat.com/browse/PITEAM-9
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3299.json
• report
  https://access.redhat.com/security/cve/CVE-2020-7692
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7692
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7692
• report
  https://access.redhat.com/security/cve/CVE-2021-4178
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-4178
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-4178
• report
  https://access.redhat.com/security/cve/CVE-2021-46877
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-46877
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-46877
• report
  https://access.redhat.com/security/cve/CVE-2022-22978
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22978
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22978
• article
  https://tanzu.vmware.com/security/cve-2022-22978
• report
  https://access.redhat.com/security/cve/CVE-2022-25647
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2080850
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-25647
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-25647
• report
  https://access.redhat.com/security/cve/CVE-2022-40151
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40151
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40151