Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update

Fixed packages 2

Vulnerabilities 9

• Critical 9.8
  CVE-2024-34144 Public exploit EPSS 48%

  Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies

  A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection a…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  May 2, 2024
• High 8.8
  CVE-2024-34145

  Jenkins Script Security Plugin sandbox bypass vulnerability

  A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  May 2, 2024
• High 8.6
  CVE-2024-21626 Public exploit EPSS 19%

  runc container breakout through process.cwd trickery and leaked fds

  runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a worki…

  opencontainers runc zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jan 31, 2024
• High 7.5
  CVE-2024-22201

  Jetty connection leaking on idle timeout when TCP congested

  Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptor…

  jetty jetty.project jetty9 jetty Debian Ubuntu Maven
  Feb 26, 2024
• High 7.5
  CVE-2024-24786

  Infinite loop in JSON unmarshaling in google.golang.org/protobuf

  The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown opti…

  google.golang.org/protobuf google.golang.org/protobuf/encoding/protojson google.golang.org/protobuf/internal/encoding/json katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 6.5
  CVE-2024-23899

  Arbitrary file read vulnerability in Git server Plugin can lead to RCE

  Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read…

  Jenkins Project Jenkins Git server Plugin org.jenkins-ci.plugins:git-server Web / CMS Maven
  Jan 24, 2024
• Medium 6.5
  CVE-2024-28149

  Jenkins HTML Publisher Plugin does not properly sanitize input

  Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file…

  Jenkins Project Jenkins HTML Publisher Plugin org.jenkins-ci.plugins:htmlpublisher Web / CMS Maven
  Mar 6, 2024
• Medium 5.9
  CVE-2023-48795 Public exploit Scanner template EPSS 94%

  Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

  The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

  zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io
  Dec 18, 2023
• Medium 4.3
  CVE-2024-23900

  Path traversal vulnerability in Jenkins Matrix Project Plugin

  Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file …

  Jenkins Project Jenkins Matrix Project Plugin org.jenkins-ci.plugins:matrix-project Web / CMS Maven
  Jan 24, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254210
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2258725
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2260183
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2260184
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266136
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268046
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268227
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278820
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278821
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4597.json
• report
  https://access.redhat.com/security/cve/CVE-2023-48795
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-48795
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-48795
• article
  https://access.redhat.com/solutions/7071748
• article
  https://terrapin-attack.com/
• report
  https://access.redhat.com/security/cve/CVE-2024-21626
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2024-001
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-21626
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-21626
• article
  https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv
• report
  https://access.redhat.com/security/cve/CVE-2024-22201
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-22201
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-22201
• article
  https://github.com/jetty/jetty.project/issues/11256
• article
  https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98
• report
  https://access.redhat.com/security/cve/CVE-2024-23899
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-23899
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-23899
• article
  http://www.openwall.com/lists/oss-security/2024/01/24/6
• article
  https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3319
• report
  https://access.redhat.com/security/cve/CVE-2024-23900
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-23900
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-23900
• article
  https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3289
• report
  https://access.redhat.com/security/cve/CVE-2024-24786
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24786
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24786
• article
  https://go.dev/cl/569356