RHSA-2026:60247HighCVSS 9.8

Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.

Published
August 26, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (28)

CVE-2025-67030 →CVE-2026-41635 →CVE-2026-42778 →CVE-2026-50193 →CVE-2026-53437 →CVE-2026-54399 →CVE-2026-1605 →CVE-2026-2332 →CVE-2026-3505 →CVE-2026-47065 →CVE-2026-54428 →CVE-2026-70427 →CVE-2026-70428 →CVE-2026-70429 →CVE-2026-42779 →CVE-2026-5588 →CVE-2026-40542 →CVE-2026-41409 →CVE-2026-54512 →CVE-2026-57281 →CVE-2026-70426 →CVE-2026-0636 →CVE-2026-53435 →CVE-2026-56624 →CVE-2026-57280 →CVE-2026-68494 →CVE-2024-29371 →CVE-2025-14813 →

📋 Description

CVE-2024-29371 — jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression CVE-2025-14813 — bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly CVE-2025-67030 — org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2026-0636 — bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java CVE-2026-1605 — org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests CVE-2026-2332 — org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing CVE-2026-3505 — bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion CVE-2026-5588 — bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid CVE-2026-40542 — httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification CVE-2026-41409 — Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix CVE-2026-41635 — Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass CVE-2026-42778 — Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) CVE-2026-42779 — Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass CVE-2026-47065 — mina: mina: Arbitrary Code Execution via Deserialization Bypass CVE-2026-50193 — jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing CVE-2026-53435 — jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration CVE-2026-53437 — jenkins: Jenkins: Phishing attack via improper redirect URL validation CVE-2026-54399 — org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers CVE-2026-54428 — org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks CVE-2026-54512 — jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass CVE-2026-56624 — org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation CVE-2026-57280 — jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution CVE-2026-57281 — jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox CVE-2026-68494 — com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser CVE-2026-70426 — jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass CVE-2026-70427 — jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links CVE-2026-70428 — jenkins: Jenkins: Arbitrary file write via path traversal CVE-2026-70429 — jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names

🎯 Affected products3

  • OpenShift Developer Tools and Services 4.12
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:34d10464449bb0698080f4ce1dff3d8e27477f46959c8b5eae830cdd2bd4d1e9_amd64 as a component of OpenShift Developer Tools and Services 4.12
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e79a3e5f5482a8001dcf546d06d54ebeeaeed4e0bc94b0f3697706ec5dabf8ee_amd64 as a component of OpenShift Developer Tools and Services 4.12

✅ Remediation

It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed. Workaround: To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion. Workaround: To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect. Workaround: Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller's file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes. Workaround: To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller's file system for any unauthorized write operations, which could indicate an attempted exploitation. Workaround: Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.

🔗 References (33)