Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Fixed packages 2

Vulnerabilities 13

• Critical 9.8
  CVE-2022-29599

  Commandline class shell injection vulnerabilities

  In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

  Apache Software Foundation Apache Maven org.apache.maven.shared:maven-shared-utils maven-shared-utils Debian Ubuntu Maven
  May 23, 2022
• High 8.8
  CVE-2023-24422 Public exploit

  Sandbox bypass in Jenkins Script Security Plugin

  A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execut…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Jan 24, 2023
• High 8.8
  CVE-2023-32981

  Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability

  An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

  Jenkins Project Jenkins Pipeline Utility Steps Plugin org.jenkins-ci.plugins:pipeline-utility-steps Web / CMS Maven
  May 16, 2023
• High 7.5
  CVE-2021-46877

  jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode

  jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Mar 18, 2023
• High 7.5
  CVE-2022-45693

  Jettison Out-of-bounds Write vulnerability

  Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.

  druid libjettison-java libjettison-java org.codehaus.jettison:jettison Debian Ubuntu Wolfi Maven
  Dec 13, 2022
• High 7.5
  CVE-2023-1370

  Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

  [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any lim…

  json-smart json-smart druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Mar 13, 2023
• High 7.5
  CVE-2023-20860 Public exploit

  Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

  Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a securit…

  libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring Debian Ubuntu Maven
  Mar 27, 2023
• Medium 6.5
  CVE-2022-40149

  Stack Buffer Overflow in Jettison

  Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may su…

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Sep 16, 2022
• Medium 6.5
  CVE-2022-40150

  Stack Buffer Overflow in Jettison

  Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may su…

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Sep 16, 2022
• Medium 6.5
  CVE-2023-20861

  Spring Framework vulnerable to denial of service via specially crafted SpEL expression

  In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

  libspring-java libspring-java org.springframework:spring-expression Debian Ubuntu Maven
  Mar 23, 2023
• Medium 5.4
  CVE-2023-32977

  Jenkins Pipeline: Job Plugin vulnerable to stored Cross-site Scripting

  Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.

  Jenkins Project Jenkins Pipeline: Job Plugin org.jenkins-ci.plugins.workflow:workflow-job Web / CMS Maven
  May 16, 2023
• Medium 4.3
  CVE-2022-30953

  Cross Site Request Forgery in Jenkins Blue Ocean Plugin

  A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.

  Jenkins Project Jenkins Blue Ocean Plugin io.jenkins.blueocean:blueocean-parent Web / CMS Maven
  May 17, 2022
• Medium 4.3
  CVE-2022-30954

  Missing permission check in Jenkins Blue Ocean Plugin

  Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

  Jenkins Project Jenkins Blue Ocean Plugin io.jenkins.blueocean:blueocean-parent Web / CMS Maven
  May 17, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066479
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2119646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2119647
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135770
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135771
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2155970
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2164278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178358
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2180528
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2180530
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2185707
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2188542
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207830
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207835
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3610.json
• report
  https://access.redhat.com/security/cve/CVE-2021-46877
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-46877
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-46877
• report
  https://access.redhat.com/security/cve/CVE-2022-29599
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29599
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29599
• report
  https://access.redhat.com/security/cve/CVE-2022-30953
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-30953
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-30953
• article
  https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502
• report
  https://access.redhat.com/security/cve/CVE-2022-30954
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-30954
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-30954
• report
  https://access.redhat.com/security/cve/CVE-2022-40149
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40149
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40149
• article
  https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1
• report
  https://access.redhat.com/security/cve/CVE-2022-40150
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40150
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40150
• report
  https://access.redhat.com/security/cve/CVE-2022-45693
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-45693
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-45693