Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

CVE-2020-7692 — google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization CVE-2021-4178 — kubernetes-client: Insecure deserialization in unmarshalYaml method CVE-2021-46877 — jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode CVE-2022-22978 — springframework: Authorization Bypass in RegexRequestMatcher CVE-2022-25647 — com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson CVE-2022-40151 — xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks CVE-2022-40152 — woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks CVE-2022-42889 — apache-commons-text: variable interpolation RCE CVE-2023-24422 — jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin CVE-2023-24998 — FileUpload: FileUpload DoS with excessive parts CVE-2023-25761 — jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin CVE-2023-25762 — jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin CVE-2023-27900 — Jenkins: Denial of Service attack CVE-2023-27901 — Jenkins: Denial of Service attack CVE-2023-27902 — Jenkins: Workspace temporary directories accessible through directory browser CVE-2023-27904 — Jenkins: Information disclosure through error stack traces related to agents