RHSA-2026:60248HighCVSS 9.8

Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.

Published
August 26, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (28)

CVE-2026-56624 →CVE-2026-57281 →CVE-2026-68494 →CVE-2026-70428 →CVE-2026-47065 →CVE-2024-29371 →CVE-2025-67030 →CVE-2026-1605 →CVE-2026-3505 →CVE-2026-57280 →CVE-2026-70426 →CVE-2026-70429 →CVE-2026-2332 →CVE-2026-53435 →CVE-2026-54428 →CVE-2026-70427 →CVE-2026-41635 →CVE-2026-42778 →CVE-2026-42779 →CVE-2025-14813 →CVE-2026-0636 →CVE-2026-5588 →CVE-2026-40542 →CVE-2026-50193 →CVE-2026-41409 →CVE-2026-53437 →CVE-2026-54399 →CVE-2026-54512 →

📋 Description

CVE-2024-29371 — jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression CVE-2025-14813 — bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly CVE-2025-67030 — org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2026-0636 — bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java CVE-2026-1605 — org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests CVE-2026-2332 — org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing CVE-2026-3505 — bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion CVE-2026-5588 — bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid CVE-2026-40542 — httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification CVE-2026-41409 — Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix CVE-2026-41635 — Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass CVE-2026-42778 — Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) CVE-2026-42779 — Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass CVE-2026-47065 — mina: mina: Arbitrary Code Execution via Deserialization Bypass CVE-2026-50193 — jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing CVE-2026-53435 — jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration CVE-2026-53437 — jenkins: Jenkins: Phishing attack via improper redirect URL validation CVE-2026-54399 — org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers CVE-2026-54428 — org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks CVE-2026-54512 — jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass CVE-2026-56624 — org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation CVE-2026-57280 — jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution CVE-2026-57281 — jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox CVE-2026-68494 — com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser CVE-2026-70426 — jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass CVE-2026-70427 — jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links CVE-2026-70428 — jenkins: Jenkins: Arbitrary file write via path traversal CVE-2026-70429 — jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names

🎯 Affected products9

  • OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 as a component of OpenShift Developer Tools and Services 4.14

✅ Remediation

It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed. Workaround: To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion. Workaround: To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed. Workaround: To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect. Workaround: Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller's file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes. Workaround: To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller's file system for any unauthorized write operations, which could indicate an attempted exploitation. Workaround: Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.

🔗 References (33)