Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Fixed packages 2

Vulnerabilities 11

• Critical 9.8
  CVE-2024-23897 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE

  Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files …

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 24, 2024

  KEV Aug 19, 2024
• Critical 9.8
  CVE-2022-29599

  Commandline class shell injection vulnerabilities

  In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

  Apache Software Foundation Apache Maven org.apache.maven.shared:maven-shared-utils maven-shared-utils Debian Ubuntu Maven
  May 23, 2022
• Critical 9.8
  CVE-2022-42889 Public exploit EPSS 100%

  Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

  Apache Software Foundation Apache Commons Text com.guicedee.services:commons-text commons-text Debian Ubuntu Maven
  Oct 13, 2022
• High 8.8
  CVE-2023-24422 Public exploit

  Sandbox bypass in Jenkins Script Security Plugin

  A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execut…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Jan 24, 2023
• High 8.8
  CVE-2023-37946

  Jenkins OpenShift Login Plugin session fixation vulnerability

  Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.

  Jenkins Project Jenkins OpenShift Login Plugin org.openshift.jenkins:openshift-login Web / CMS Maven
  Jul 12, 2023
• High 8.8
  CVE-2024-23898 Public exploit EPSS 67%

  Cross-site WebSocket hijacking vulnerability in the Jenkins CLI

  Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing at…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 24, 2024
• High 8.3
  CVE-2022-1471 Public exploit EPSS 100%

  Remote Code execution in SnakeYAML

  SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 cassandra-reaper Debian Ubuntu Wolfi Maven
  Dec 1, 2022
• Medium 5.4
  CVE-2023-25761

  Cross-site Scripting in Jenkins JUnit Plugin

  Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit re…

  Jenkins Project Jenkins JUnit Plugin org.jenkins-ci.plugins:junit Web / CMS Maven
  Feb 15, 2023
• Medium 5.4
  CVE-2023-25762 EPSS 82%

  Cross-site Scripting in Jenkins Pipeline: Build Step Plugin

  Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

  Jenkins Project Jenkins Pipeline: Build Step Plugin org.jenkins-ci.plugins:pipeline-build-step Web / CMS Maven
  Feb 15, 2023
• Medium 5.3
  CVE-2023-27904

  Information disclosure through error stack traces related to agents

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023
• Medium 4.4
  CVE-2023-27903

  Incorrect Authorization in Jenkins Core

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to …

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066479
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135435
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2164278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170039
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170041
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2222709
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2260180
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2260182
• article
  https://issues.redhat.com/browse/OCPBUGS-471
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0775.json
• report
  https://access.redhat.com/security/cve/CVE-2022-1471
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1471
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1471
• article
  https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
• report
  https://access.redhat.com/security/cve/CVE-2022-29599
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-29599
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-29599
• report
  https://access.redhat.com/security/cve/CVE-2022-42889
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-42889
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-42889
• article
  https://blogs.apache.org/security/entry/cve-2022-42889
• article
  https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
• article
  https://seclists.org/oss-sec/2022/q4/22
• report
  https://access.redhat.com/security/cve/CVE-2023-24422
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24422
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24422
• article
  https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-3016
• report
  https://access.redhat.com/security/cve/CVE-2023-25761
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-25761
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-25761
• article
  https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3032
• report
  https://access.redhat.com/security/cve/CVE-2023-25762
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-25762
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-25762
• article
  https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3019