Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Fixed packages 2

Vulnerabilities 17

• Critical 9.6
  CVE-2023-27898

  Cross-site Scripting vulnerability in Jenkins

  Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023
• High 8.8
  CVE-2023-32981

  Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability

  An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

  Jenkins Project Jenkins Pipeline Utility Steps Plugin org.jenkins-ci.plugins:pipeline-utility-steps Web / CMS Maven
  May 16, 2023
• High 8.2
  CVE-2022-41966 Public exploit

  XStream Denial of Service via stack overflow

  XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack…

  x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  Dec 27, 2022
• High 7.5
  CVE-2022-2048

  Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of service

  In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario w…

  The Eclipse Foundation Eclipse Jetty jetty9 jenkins Debian Ubuntu Alpine Maven
  Jul 7, 2022
• High 7.5
  CVE-2022-42003

  Uncontrolled Resource Consumption in Jackson-databind

  In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

  management-api-for-apache-cassandra-5.0 jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Oct 2, 2022
• High 7.5
  CVE-2022-42004

  Uncontrolled Resource Consumption in FasterXML jackson-databind

  In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for des…

  management-api-for-apache-cassandra-5.0 jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Oct 2, 2022
• High 7.5
  CVE-2023-1370

  Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

  [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any lim…

  json-smart json-smart druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Mar 13, 2023
• High 7.5
  CVE-2023-20860 Public exploit

  Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

  Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a securit…

  libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring Debian Ubuntu Maven
  Mar 27, 2023
• High 7.5
  CVE-2023-26464

  Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender

  ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on wh…

  Apache Software Foundation Apache Log4j druid org.apache.logging.log4j:log4j-core Ubuntu Wolfi Maven
  Mar 10, 2023
• High 7.0
  CVE-2023-27899

  Incorrect Authorization in Jenkins Core

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a plugin for installation, potentially allowing attackers with access to the Jen…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023
• Medium 6.5
  CVE-2022-40149

  Stack Buffer Overflow in Jettison

  Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may su…

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Sep 16, 2022
• Medium 6.5
  CVE-2022-40150

  Stack Buffer Overflow in Jettison

  Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may su…

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Sep 16, 2022
• Medium 5.9
  CVE-2023-1436

  Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

  An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Mar 16, 2023
• Medium 5.4
  CVE-2023-32977

  Jenkins Pipeline: Job Plugin vulnerable to stored Cross-site Scripting

  Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.

  Jenkins Project Jenkins Pipeline: Job Plugin org.jenkins-ci.plugins.workflow:workflow-job Web / CMS Maven
  May 16, 2023
• Medium 5.3
  CVE-2022-22976 Public exploit

  Integer overflow in BCrypt class in Spring Security

  Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due t…

  libspring-java org.springframework.security:spring-security-core Ubuntu Maven
  May 19, 2022
• Medium 5.3
  CVE-2023-27904

  Information disclosure through error stack traces related to agents

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023
• Medium 4.4
  CVE-2023-27903

  Incorrect Authorization in Jenkins Core

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to …

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2087214
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2116952
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135244
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135247
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135770
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135771
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177626
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177629
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2180528
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2182788
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2182864
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2188542
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207830
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207835
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3663.json
• report
  https://access.redhat.com/security/cve/CVE-2022-2048
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2048
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2048
• article
  https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j
• report
  https://access.redhat.com/security/cve/CVE-2022-22976
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-22976
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-22976
• article
  https://tanzu.vmware.com/security/cve-2022-22976
• report
  https://access.redhat.com/security/cve/CVE-2022-40149
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40149
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40149
• article
  https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1
• report
  https://access.redhat.com/security/cve/CVE-2022-40150
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-40150
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-40150
• report
  https://access.redhat.com/security/cve/CVE-2022-41966
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41966
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41966
• article
  https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv
• report
  https://access.redhat.com/security/cve/CVE-2022-42003