Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update

Fixed packages 2

Vulnerabilities 24

• Critical 9.8
  CVE-2024-23897 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE

  Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files …

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 24, 2024

  KEV Aug 19, 2024
• Critical 9.8
  CVE-2022-29599

  Commandline class shell injection vulnerabilities

  In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

  Apache Software Foundation Apache Maven org.apache.maven.shared:maven-shared-utils maven-shared-utils Debian Ubuntu Maven
  May 23, 2022
• Critical 9.8
  CVE-2022-42889 Public exploit EPSS 100%

  Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

  Apache Software Foundation Apache Commons Text com.guicedee.services:commons-text commons-text Debian Ubuntu Maven
  Oct 13, 2022
• Critical 9.1
  CVE-2021-26291 Public exploit

  block repositories using http by default

  Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a posit…

  Apache Software Foundation Apache Maven org.apache.maven:maven-core maven Debian Ubuntu Maven
  Apr 23, 2021
• High 8.8
  CVE-2023-24422 Public exploit

  Sandbox bypass in Jenkins Script Security Plugin

  A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execut…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Jan 24, 2023
• High 8.8
  CVE-2024-23898 Public exploit EPSS 67%

  Cross-site WebSocket hijacking vulnerability in the Jenkins CLI

  Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing at…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Jan 24, 2024
• High 7.5
  CVE-2022-25857

  Denial of Service (DoS)

  The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

  management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat org.yaml:snakeyaml snakeyaml Debian Ubuntu Wolfi Maven
  Aug 30, 2022
• High 7.4
  CVE-2020-7692

  Improper Authorization

  PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization requ…

  com.google.oauth-client:google-oauth-client google-oauth-client-java google-oauth-client-java Debian Ubuntu Maven
  Jul 9, 2020
• Medium 6.5
  CVE-2023-20861

  Spring Framework vulnerable to denial of service via specially crafted SpEL expression

  In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

  libspring-java libspring-java org.springframework:spring-expression Debian Ubuntu Maven
  Mar 23, 2023
• Medium 6.3
  CVE-2023-20862

  Spring Security logout not clearing security context

  In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly s…

  org.springframework.security:spring-security-core Maven
  Apr 19, 2023
• Medium 5.5
  CVE-2022-1962

  Stack exhaustion due to deeply nested types in go/parser

  Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

  Go standard library go/parser golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Medium 5.5
  CVE-2023-2976

  Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

  Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

  Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven
  Jun 14, 2023
• Medium 5.4
  CVE-2023-25761

  Cross-site Scripting in Jenkins JUnit Plugin

  Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit re…

  Jenkins Project Jenkins JUnit Plugin org.jenkins-ci.plugins:junit Web / CMS Maven
  Feb 15, 2023
• Medium 5.4
  CVE-2023-25762 EPSS 82%

  Cross-site Scripting in Jenkins Pipeline: Build Step Plugin

  Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

  Jenkins Project Jenkins Pipeline: Build Step Plugin org.jenkins-ci.plugins:pipeline-build-step Web / CMS Maven
  Feb 15, 2023
• Medium 5.4
  CVE-2023-40341

  Jenkins Blue Ocean Plugin cross-site request forgery vulnerability

  A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job.

  Jenkins Project Jenkins Blue Ocean Plugin io.jenkins.blueocean:blueocean Web / CMS Maven
  Aug 16, 2023
• Medium 5.3
  CVE-2023-26048 Public exploit

  OutOfMemoryError for large multipart without filename in Eclipse Jetty

  Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` wh…

  Eclipse Foundation jetty.project cassandra-reaper jetty9 Debian Ubuntu Wolfi Maven
  Apr 18, 2023
• Medium 5.3
  CVE-2023-27904

  Information disclosure through error stack traces related to agents

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023
• Medium 5.3
  CVE-2023-40167 Public exploit

  Jetty accepts "+" prefixed value in Content-Length

  Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and othe…

  Eclipse Foundation jetty.project druid cassandra-reaper Debian Ubuntu Wolfi Maven
  Sep 15, 2023
• Medium 4.4
  CVE-2023-27903

  Incorrect Authorization in Jenkins Core

  Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to …

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Mar 8, 2023
• Medium 4.3
  CVE-2023-37947

  Jenkins OpenShift Login Plugin vulnerable to Open Redirect

  Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.

  Jenkins Project Jenkins OpenShift Login Plugin org.openshift.jenkins:openshift-login Web / CMS Maven
  Jul 12, 2023
• Medium 4.3
  CVE-2023-40337

  Jenkins Folders Plugin cross-site request forgery vulnerability

  A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view inside a folder.

  Jenkins Project Jenkins Folders Plugin org.jenkins-ci.plugins:cloudbees-folder Web / CMS Maven
  Aug 16, 2023
• Medium 4.3
  CVE-2023-40338

  Jenkins Folders Plugin information disclosure vulnerability

  Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Scan Organization Folder Log if no logs are available, exposing information about the Jenkins controlle…

  Jenkins Project Jenkins Folders Plugin org.jenkins-ci.plugins:cloudbees-folder Web / CMS Maven
  Aug 16, 2023
• Medium 4.3
  CVE-2023-40339

  Jenkins Config File Provider Plugin improper credential masking vulnerability

  Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they're written to the build log.

  Jenkins Project Jenkins Config File Provider Plugin org.jenkins-ci.plugins:config-file-provider Web / CMS Maven
  Aug 16, 2023
• Low 2.4
  CVE-2023-26049 Public exploit

  Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty

  Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a co…

  Eclipse Foundation jetty.project cassandra-reaper jetty9 Debian Ubuntu Wolfi Maven
  Apr 18, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1856376
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1955739
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066479
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107376
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2126789
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135435
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2164278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170039
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170041
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2180530
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215229
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2222710
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2227788
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2232422
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2232423
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2232425
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2232426
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2236340
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2236341
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2239634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2260180
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2260182
• article
  https://issues.redhat.com/browse/JKNS-271
• article
  https://issues.redhat.com/browse/JKNS-289
• article
  https://issues.redhat.com/browse/OCPBUGS-10976
• article
  https://issues.redhat.com/browse/OCPBUGS-11158
• article
  https://issues.redhat.com/browse/OCPBUGS-11348
• article
  https://issues.redhat.com/browse/OCPBUGS-1357
• article
  https://issues.redhat.com/browse/OCPBUGS-13652
• article
  https://issues.redhat.com/browse/OCPBUGS-13901
• article
  https://issues.redhat.com/browse/OCPBUGS-14113
• article
  https://issues.redhat.com/browse/OCPBUGS-14393
• article
  https://issues.redhat.com/browse/OCPBUGS-14642
• article
  https://issues.redhat.com/browse/OCPBUGS-15648
• article
  https://issues.redhat.com/browse/OCPBUGS-1709
• article
  https://issues.redhat.com/browse/OCPBUGS-1942