Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 Openshift Jenkins security update

Fixed packages 2

Vulnerabilities 5

• High 8.0
  CVE-2024-52550 Public exploit

  Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin

  Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build who…

  Jenkins Project Jenkins Pipeline: Groovy Plugin org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven
  Nov 13, 2024
• High 8.0
  CVE-2024-52551

  Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin

  Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous buil…

  Jenkins Project Jenkins Pipeline: Declarative Plugin org.jenkinsci.plugins:pipeline-model-parent Web / CMS Maven
  Nov 13, 2024
• High 7.5
  CVE-2024-47072

  XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream

  XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream wh…

  x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  Nov 7, 2024
• Medium 5.3
  CVE-2024-47855 EPSS 18%

  JSON-lib mishandles an unbalanced comment string

  util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.

  libjson-java libjson-java org.kordamp.json:json-lib-core net.sf.json-lib:json-lib Debian Ubuntu Maven
  Oct 4, 2024
• Medium 4.3
  CVE-2024-52549

  Missing permission check in Jenkins Script Security Plugin

  Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to ch…

  Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  Nov 13, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2316421
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2324606
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2326034
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2326043
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2326047
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2219.json
• report
  https://access.redhat.com/security/cve/CVE-2024-47072
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-47072
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-47072
• article
  https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266
• article
  https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q
• article
  https://x-stream.github.io/CVE-2024-47072.html
• report
  https://access.redhat.com/security/cve/CVE-2024-47855
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-47855
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-47855
• advisory
  https://github.com/advisories/GHSA-wwcp-26wc-3fxm
• article
  https://github.com/kordamp/json-lib/commit/a0c4a0eae277130e22979cf307c95dec4005a78e
• article
  https://github.com/kordamp/json-lib/compare/v3.0.3...v3.1.0
• report
  https://access.redhat.com/security/cve/CVE-2024-52549
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-52549
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-52549
• article
  https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3447
• report
  https://access.redhat.com/security/cve/CVE-2024-52550
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-52550
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-52550
• article
  https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3362
• report
  https://access.redhat.com/security/cve/CVE-2024-52551
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-52551
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-52551
• article
  https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3361