Skip to content
OpenAdvisories
High RHSA-2025:10118 4 CVEs

Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update

Published Jul 2, 2025 · Updated Sep 15, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Ocp Tools 4 ocp_tools:4.12::el8 jenkins 0:2.504.2.1750932984-3.el8
Red Hat · Ocp Tools 4 ocp_tools:4.12::el8 jenkins-2-plugins 0:4.12.1750933270-1.el8

Vulnerabilities 4

  • High 8.7
    CVE-2025-52999 Public exploit

    jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested data

    jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a Stackov…

    FasterXML jackson-core druid tez Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2024-57699

    Netplex Json-smart Uncontrolled Recursion vulnerability

    A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issu…

    trino trino-plugin-opensearch trino-plugin-lakehouse trino-plugin-pinot Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2025-1948

    Eclipse Jetty HTTP clients can increase memory allocation

    In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a…

    Eclipse Foundation Jetty jetty9 jetty Debian Ubuntu Maven
  • High 7.4
    CVE-2025-22228

    CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length

    BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

    Spring Spring Security thingsboard-tb-node thingsboard-tb-mqtt-transport Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2344073
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2353507
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2365137
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2374804
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10118.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-57699
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-57699
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-57699
  • article
    https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699
  • advisory
    https://nvd.nist.gov/vuln/detail/cve-2023-1370
  • report
    https://access.redhat.com/security/cve/CVE-2025-1948
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-1948
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-1948
  • article
    https://github.com/jetty/jetty.project/security/advisories/GHSA-889j-63jv-qhr8
  • article
    https://gitlab.eclipse.org/security/cve-assignement/-/issues/56
  • report
    https://access.redhat.com/security/cve/CVE-2025-22228
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-22228
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-22228
  • article
    https://spring.io/security/cve-2025-22228
  • report
    https://access.redhat.com/security/cve/CVE-2025-52999
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-52999
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-52999
  • article
    https://github.com/FasterXML/jackson-core/pull/943
  • article
    https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3