RHSA-2023:3198CriticalCVSS 9.9

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Published
May 17, 2023
Last Modified
August 13, 2026

🔗 CVE IDs covered (22)

CVE-2022-29599 →CVE-2022-30954 →CVE-2022-43402 →CVE-2022-43403 →CVE-2022-43405 →CVE-2022-43407 →CVE-2022-45047 →CVE-2023-25761 →CVE-2021-26291 →CVE-2022-1471 →CVE-2022-30953 →CVE-2022-43409 →CVE-2023-24422 →CVE-2023-25762 →CVE-2023-27903 →CVE-2023-27904 →CVE-2022-25857 →CVE-2022-42889 →CVE-2022-43401 →CVE-2022-43404 →CVE-2022-43406 →CVE-2022-43408 →

📋 Description

CVE-2021-26291 — maven: Block repositories using http by default CVE-2022-1471 — SnakeYaml: Constructor Deserialization Remote Code Execution CVE-2022-25857 — snakeyaml: Denial of Service due to missing nested depth limitation for collections CVE-2022-29599 — maven-shared-utils: Command injection via Commandline class CVE-2022-30953 — plugin: CSRF vulnerability in Blue Ocean Plugin CVE-2022-30954 — plugin: missing permission checks in Blue Ocean Plugin CVE-2022-42889 — apache-commons-text: variable interpolation RCE CVE-2022-43401 — jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin CVE-2022-43402 — jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin CVE-2022-43403 — jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin CVE-2022-43404 — jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin CVE-2022-43405 — jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin CVE-2022-43406 — jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin CVE-2022-43407 — jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin CVE-2022-43408 — jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin CVE-2022-43409 — jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin CVE-2022-45047 — mina-sshd: Java unsafe deserialization vulnerability CVE-2023-24422 — jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin CVE-2023-25761 — jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin CVE-2023-25762 — jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin CVE-2023-27903 — Jenkins: Temporary file parameter created with insecure permissions CVE-2023-27904 — Jenkins: Information disclosure through error stack traces related to agents

🎯 Affected products5

  • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • jenkins-0:2.387.1.1683009763-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • jenkins-0:2.387.1.1683009763-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • jenkins-2-plugins-0:4.11.1683009941-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • jenkins-2-plugins-0:4.11.1683009941-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http. Workaround: This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations. Workaround: Restrict the ability to configure Jenkins Pipelines to trusted users only. Upgrade to Jenkins Pipeline: Stage View Plugin version 2.27 or later, which correctly encodes input step IDs in generated URLs. Workaround: From the maintainer: For Apache MINA SSHD <= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server's host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of SimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).

🔗 References (26)