Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update

Fixed packages 2

Vulnerabilities 1

• High 8.8
  CVE-2024-43044 Public exploit EPSS 29%

  Jenkins Remoting library arbitrary file read vulnerability

  Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core org.jenkins-ci.main:remoting Web / CMS Maven
  Aug 7, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2303466
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5405.json
• report
  https://access.redhat.com/security/cve/CVE-2024-43044
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-43044
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-43044
• article
  https://www.jenkins.io/security/advisory/2024-08-07/#SECURITY-3430