RHSA-2023:1064CriticalCVSS 9.9

Red Hat Security Advisory: OpenShift Developer Tools and Services for OCP 4.12 security update

Published
March 6, 2023
Last Modified
August 13, 2026

🔗 CVE IDs covered (15)

CVE-2022-43401 →CVE-2022-43403 →CVE-2022-43407 →CVE-2022-43409 →CVE-2022-45047 →CVE-2022-29047 →CVE-2022-30952 →CVE-2022-43405 →CVE-2022-43408 →CVE-2022-42003 →CVE-2022-43402 →CVE-2022-43404 →CVE-2022-42004 →CVE-2022-43406 →CVE-2022-43410 →

📋 Description

CVE-2022-29047 — Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin CVE-2022-30952 — plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin CVE-2022-42003 — jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS CVE-2022-42004 — jackson-databind: use of deeply nested arrays CVE-2022-43401 — jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin CVE-2022-43402 — jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin CVE-2022-43403 — jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin CVE-2022-43404 — jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin CVE-2022-43405 — jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin CVE-2022-43406 — jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin CVE-2022-43407 — jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin CVE-2022-43408 — jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin CVE-2022-43409 — jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin CVE-2022-43410 — jenkins-plugin/mercurial: Webhook endpoint discloses job names to unauthorized users in Mercurial Plugin CVE-2022-45047 — mina-sshd: Java unsafe deserialization vulnerability

🎯 Affected products5

  • OpenShift Developer Tools and Services for OCP 4.12
  • jenkins-0:2.361.4.1675702346-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.12
  • jenkins-0:2.361.4.1675702346-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.12
  • jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.12
  • jenkins-2-plugins-0:4.12.1675702407-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.12

✅ Remediation

For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release: https://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html Workaround: Restrict the ability to configure Jenkins Pipelines to trusted users only. Upgrade to Jenkins Pipeline: Stage View Plugin version 2.27 or later, which correctly encodes input step IDs in generated URLs. Workaround: From the maintainer: For Apache MINA SSHD <= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server's host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of SimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).

🔗 References (18)