Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

CVE-2022-2048 — http2-server: Invalid HTTP/2 requests cause DoS CVE-2022-22976 — springframework: BCrypt skips salt rounds for work factor of 31 CVE-2022-40149 — jettison: parser crash by stackoverflow CVE-2022-40150 — jettison: memory exhaustion via user-supplied XML or JSON data CVE-2022-41966 — xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow CVE-2022-42003 — jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS CVE-2022-42004 — jackson-databind: use of deeply nested arrays CVE-2023-1370 — json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) CVE-2023-1436 — jettison: Uncontrolled Recursion in JSONArray CVE-2023-20860 — springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern CVE-2023-26464 — log4j1-socketappender: DoS via hashmap logging CVE-2023-27898 — Jenkins: XSS vulnerability in plugin manager CVE-2023-27899 — Jenkins: Temporary plugin file created with insecure permissions CVE-2023-27903 — Jenkins: Temporary file parameter created with insecure permissions CVE-2023-27904 — Jenkins: Information disclosure through error stack traces related to agents CVE-2023-32977 — jenkins-2-plugin: workflow-job: Stored XSS vulnerability in Pipeline: Job Plugin CVE-2023-32981 — jenkins-2-plugin: pipeline-utility-steps: Arbitrary file write vulnerability on agents in Pipeline Utility Steps Plugin