RHSA-2023:3622HighCVSS 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Published
June 15, 2023
Last Modified
August 6, 2026

🔗 CVE IDs covered (9)

CVE-2022-29599 →CVE-2022-30953 →CVE-2023-1370 →CVE-2023-1436 →CVE-2023-20860 →CVE-2023-20861 →CVE-2023-27903 →CVE-2023-27904 →CVE-2022-30954 →

📋 Description

CVE-2022-29599 — maven-shared-utils: Command injection via Commandline class CVE-2022-30953 — plugin: CSRF vulnerability in Blue Ocean Plugin CVE-2022-30954 — plugin: missing permission checks in Blue Ocean Plugin CVE-2023-1370 — json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) CVE-2023-1436 — jettison: Uncontrolled Recursion in JSONArray CVE-2023-20860 — springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern CVE-2023-20861 — springframework: Spring Expression DoS Vulnerability CVE-2023-27903 — Jenkins: Temporary file parameter created with insecure permissions CVE-2023-27904 — Jenkins: Information disclosure through error stack traces related to agents

🎯 Affected products5

  • OpenShift Developer Tools and Services for OCP 4.13
  • jenkins-0:2.401.1.1686680404-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.13
  • jenkins-0:2.401.1.1686680404-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.13
  • jenkins-2-plugins-0:4.13.1686680473-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.13
  • jenkins-2-plugins-0:4.13.1686680473-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.13

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

🔗 References (13)