Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update

Fixed packages 2

Vulnerabilities 5

• Critical 9.8
  CVE-2024-34144 Public exploit EPSS 48%

  Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies

  A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection a…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  May 2, 2024
• High 7.4
  CVE-2021-44549

  SMTPS server hostname not checked when making TLS connection to SMTPS server

  Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. Fo…

  Apache Software Foundation Apache Sling Commons Messaging Mail org.apache.sling:org.apache.sling.commons.messaging.mail Maven
  Dec 14, 2021
• Medium 4.3
  CVE-2024-38808

  CVE-2024-38808: Spring Expression DoS Vulnerability

  In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application …

  Spring Spring Framework apache-nifi libspring-java Debian Ubuntu Wolfi Maven
  Aug 20, 2024
• Medium 4.3
  CVE-2024-47803

  Jenkins exposes multi-line secrets through error messages

  Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form field.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Oct 2, 2024
• Medium 4.3
  CVE-2024-47804

  Jenkins item creation restriction bypass vulnerability

  If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 an…

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Oct 2, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8886.json
• report
  https://access.redhat.com/security/cve/CVE-2021-44549
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315808
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44549
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44549
• report
  https://access.redhat.com/security/cve/CVE-2024-34144
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278820
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-34144
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-34144
• article
  http://www.openwall.com/lists/oss-security/2024/05/02/3
• article
  https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3341
• report
  https://access.redhat.com/security/cve/CVE-2024-38808
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2305959
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-38808
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-38808
• article
  https://spring.io/security/cve-2024-38808
• report
  https://access.redhat.com/security/cve/CVE-2024-47803
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2316137
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-47803
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-47803
• article
  https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3451
• report
  https://access.redhat.com/security/cve/CVE-2024-47804
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2316131
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-47804
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-47804
• article
  https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3448