Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Fixed packages 2

Vulnerabilities 17

• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• Critical 9.8
  CVE-2022-29599

  Commandline class shell injection vulnerabilities

  In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

  Apache Software Foundation Apache Maven maven-shared-utils maven-shared-utils Debian Ubuntu Maven
  May 23, 2022
• Critical 9.8
  CVE-2022-42889 Public exploit EPSS 100%

  Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

  Apache Software Foundation Apache Commons Text com.guicedee.services:commons-text commons-text Debian Ubuntu Maven
  Oct 13, 2022
• High 8.8
  CVE-2023-24422 Public exploit

  Sandbox bypass in Jenkins Script Security Plugin

  A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execut…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Jan 24, 2023
• High 8.8
  CVE-2023-37946

  Jenkins OpenShift Login Plugin session fixation vulnerability

  Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.

  Jenkins Project Jenkins OpenShift Login Plugin org.openshift.jenkins:openshift-login Web / CMS Maven
  Jul 12, 2023
• High 8.0
  CVE-2023-40336

  Jenkins Folders Plugin cross-site request forgery vulnerability

  A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders.

  Jenkins Project Jenkins Folders Plugin org.jenkins-ci.plugins:cloudbees-folder Web / CMS Maven
  Aug 16, 2023
• High 7.5
  CVE-2022-25857

  Denial of Service (DoS)

  The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

  management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat org.yaml:snakeyaml snakeyaml Debian Ubuntu Wolfi Maven
  Aug 30, 2022
• High 7.5
  CVE-2023-39325 Public exploit

  HTTP/2 rapid reset can cause excessive work in net/http

  A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 11, 2023
• Medium 5.5
  CVE-2023-2976

  Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

  Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

  Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven
  Jun 14, 2023
• Medium 5.4
  CVE-2023-25761

  Cross-site Scripting in Jenkins JUnit Plugin

  Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit re…

  Jenkins Project Jenkins JUnit Plugin org.jenkins-ci.plugins:junit Web / CMS Maven
  Feb 15, 2023
• Medium 5.4
  CVE-2023-25762 EPSS 82%

  Cross-site Scripting in Jenkins Pipeline: Build Step Plugin

  Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

  Jenkins Project Jenkins Pipeline: Build Step Plugin org.jenkins-ci.plugins:pipeline-build-step Web / CMS Maven
  Feb 15, 2023
• Medium 5.4
  CVE-2023-40341

  Jenkins Blue Ocean Plugin cross-site request forgery vulnerability

  A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job.

  Jenkins Project Jenkins Blue Ocean Plugin io.jenkins.blueocean:blueocean Web / CMS Maven
  Aug 16, 2023
• Medium 4.3
  CVE-2023-37947

  Jenkins OpenShift Login Plugin vulnerable to Open Redirect

  Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.

  Jenkins Project Jenkins OpenShift Login Plugin org.openshift.jenkins:openshift-login Web / CMS Maven
  Jul 12, 2023
• Medium 4.3
  CVE-2023-40337

  Jenkins Folders Plugin cross-site request forgery vulnerability

  A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.

  Jenkins Project Jenkins Folders Plugin org.jenkins-ci.plugins:cloudbees-folder Web / CMS Maven
  Aug 16, 2023
• Medium 4.3
  CVE-2023-40338

  Jenkins Folders Plugin information disclosure vulnerability

  Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available, exposing information about the Jenkins controlle…

  Jenkins Project Jenkins Folders Plugin org.jenkins-ci.plugins:cloudbees-folder Web / CMS Maven
  Aug 16, 2023
• Medium 4.3
  CVE-2023-40339

  Jenkins Config File Provider Plugin improper credential masking vulnerability

  Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Aug 16, 2023
• Unscored —
  CVE-2023-35116

  jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted…

  Jun 14, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066479
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2126789
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135435
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2164278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170039
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170041
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215214
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215229
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2222709
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2222710
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2232422
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2232423
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2232424
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2232425
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2232426
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242803
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2243296
• article
  https://issues.redhat.com/browse/JKNS-271
• article
  https://issues.redhat.com/browse/JKNS-289
• article
  https://issues.redhat.com/browse/JKNS-337
• article
  https://issues.redhat.com/browse/JKNS-344
• article
  https://issues.redhat.com/browse/JKNS-345
• article
  https://issues.redhat.com/browse/OCPBUGS-11158
• article
  https://issues.redhat.com/browse/OCPBUGS-11253
• article
  https://issues.redhat.com/browse/OCPBUGS-11254
• article
  https://issues.redhat.com/browse/OCPBUGS-11446
• article
  https://issues.redhat.com/browse/OCPBUGS-1357
• article
  https://issues.redhat.com/browse/OCPBUGS-13869
• article
  https://issues.redhat.com/browse/OCPBUGS-14111
• article
  https://issues.redhat.com/browse/OCPBUGS-14609
• article
  https://issues.redhat.com/browse/OCPBUGS-15646
• article
  https://issues.redhat.com/browse/OCPBUGS-15902
• article
  https://issues.redhat.com/browse/OCPBUGS-1709
• article
  https://issues.redhat.com/browse/OCPBUGS-1942
• article
  https://issues.redhat.com/browse/OCPBUGS-2099
• article
  https://issues.redhat.com/browse/OCPBUGS-2184
• article
  https://issues.redhat.com/browse/OCPBUGS-2318