Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Fixed packages 2

Vulnerabilities 9

• Critical 9.8
  CVE-2022-29599

  Commandline class shell injection vulnerabilities

  In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

  Apache Software Foundation Apache Maven org.apache.maven.shared:maven-shared-utils maven-shared-utils Debian Ubuntu Maven
  May 23, 2022
• High 7.5
  CVE-2023-1370

  Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

  [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any lim…

  json-smart json-smart druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Mar 13, 2023
• High 7.5
  CVE-2023-20860 Public exploit

  Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

  Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a securit…

  libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring Debian Ubuntu Maven
  Mar 27, 2023
• Medium 6.5
  CVE-2023-20861

  Spring Framework vulnerable to denial of service via specially crafted SpEL expression

  In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

  libspring-java libspring-java org.springframework:spring-expression Debian Ubuntu Maven
  Mar 23, 2023
• Medium 5.9
  CVE-2023-1436

  Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

  An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Mar 16, 2023
• Medium 5.3
  CVE-2023-27904

  Information disclosure through error stack traces related to agents

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023
• Medium 4.4
  CVE-2023-27903

  Incorrect Authorization in Jenkins Core

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to …

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023
• Medium 4.3
  CVE-2022-30953

  Cross Site Request Forgery in Jenkins Blue Ocean Plugin

  A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.

  Jenkins Project Jenkins Blue Ocean Plugin io.jenkins.blueocean:blueocean-parent Web / CMS Maven
  May 17, 2022
• Medium 4.3
  CVE-2022-30954

  Missing permission check in Jenkins Blue Ocean Plugin

  Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

  Jenkins Project Jenkins Blue Ocean Plugin io.jenkins.blueocean:blueocean-parent Web / CMS Maven
  May 17, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.openshift.com/container-platform/4.13/cicd/jenkins/important-changes-to-openshift-jenkins-images.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066479
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2119646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2119647
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2180528
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2180530
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2182788
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2188542
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3622.json
• report
  https://access.redhat.com/security/cve/CVE-2022-29599
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29599
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29599
• report
  https://access.redhat.com/security/cve/CVE-2022-30953
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-30953
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-30953
• article
  https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502
• report
  https://access.redhat.com/security/cve/CVE-2022-30954
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-30954
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-30954
• report
  https://access.redhat.com/security/cve/CVE-2023-1370
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-1370
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-1370
• advisory
  https://github.com/advisories/GHSA-493p-pfq6-5258
• article
  https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/
• report
  https://access.redhat.com/security/cve/CVE-2023-1436
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-1436
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-1436
• article
  https://research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911/
• report
  https://access.redhat.com/security/cve/CVE-2023-20860
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-20860
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-20860
• article
  https://spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023-20860-and-cve-2023-20861
• report
  https://access.redhat.com/security/cve/CVE-2023-20861
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-20861
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-20861
• report
  https://access.redhat.com/security/cve/CVE-2023-27903