RHSA-2024:0776HighCVSS 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Published
February 12, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (10)

CVE-2022-29599 →CVE-2022-42889 →CVE-2023-24422 →CVE-2023-25762 →CVE-2023-37946 →CVE-2023-25761 →CVE-2024-23897 →CVE-2024-23898 →CVE-2021-26291 →CVE-2022-25857 →

📋 Description

CVE-2021-26291 — maven: Block repositories using http by default CVE-2022-25857 — snakeyaml: Denial of Service due to missing nested depth limitation for collections CVE-2022-29599 — maven-shared-utils: Command injection via Commandline class CVE-2022-42889 — apache-commons-text: variable interpolation RCE CVE-2023-24422 — jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin CVE-2023-25761 — jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin CVE-2023-25762 — jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin CVE-2023-37946 — Jenkins: Session fixation vulnerability in OpenShift Login Plugin CVE-2024-23897 — jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE CVE-2024-23898 — jenkins: cross-site WebSocket hijacking

🎯 Affected products5

  • OpenShift Developer Tools and Services for OCP 4.13
  • jenkins-0:2.426.3.1706516254-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.13
  • jenkins-0:2.426.3.1706516254-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.13
  • jenkins-2-plugins-0:4.13.1706516346-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.13
  • jenkins-2-plugins-0:4.13.1706516346-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.13

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http. Workaround: This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations. Workaround: Disabling access to the CLI is expected to prevent exploitation completely. Doing so is strongly recommended to administrators unable to immediately update to Jenkins 2.442, LTS 2.426.3 or LTS 2.440.1. Applying this workaround does not require a Jenkins restart.

🔗 References (41)