RHSA-2024:0775HighCVSS 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Published
February 12, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (11)

CVE-2024-23898 →CVE-2022-1471 →CVE-2022-29599 →CVE-2023-25762 →CVE-2023-27903 →CVE-2024-23897 →CVE-2022-42889 →CVE-2023-24422 →CVE-2023-25761 →CVE-2023-27904 →CVE-2023-37946 →

📋 Description

CVE-2022-1471 — SnakeYaml: Constructor Deserialization Remote Code Execution CVE-2022-29599 — maven-shared-utils: Command injection via Commandline class CVE-2022-42889 — apache-commons-text: variable interpolation RCE CVE-2023-24422 — jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin CVE-2023-25761 — jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin CVE-2023-25762 — jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin CVE-2023-27903 — Jenkins: Temporary file parameter created with insecure permissions CVE-2023-27904 — Jenkins: Information disclosure through error stack traces related to agents CVE-2023-37946 — Jenkins: Session fixation vulnerability in OpenShift Login Plugin CVE-2024-23897 — jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE CVE-2024-23898 — jenkins: cross-site WebSocket hijacking

🎯 Affected products5

  • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • jenkins-0:2.426.3.1706516929-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • jenkins-0:2.426.3.1706516929-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • jenkins-2-plugins-0:4.11.1706516946-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • jenkins-2-plugins-0:4.11.1706516946-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations. Workaround: Disabling access to the CLI is expected to prevent exploitation completely. Doing so is strongly recommended to administrators unable to immediately update to Jenkins 2.442, LTS 2.426.3 or LTS 2.440.1. Applying this workaround does not require a Jenkins restart.

🔗 References (15)