RHSA-2026:60254HighCVSS 9.8

Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.

Published
August 26, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (28)

CVE-2024-29371 →CVE-2026-40542 →CVE-2026-41635 →CVE-2026-42778 →CVE-2026-50193 →CVE-2026-54399 →CVE-2026-54428 →CVE-2025-67030 →CVE-2026-0636 →CVE-2026-1605 →CVE-2026-2332 →CVE-2026-47065 →CVE-2026-53437 →CVE-2026-57281 →CVE-2026-70427 →CVE-2026-3505 →CVE-2026-5588 →CVE-2026-41409 →CVE-2026-57280 →CVE-2026-70426 →CVE-2026-70428 →CVE-2026-70429 →CVE-2025-14813 →CVE-2026-42779 →CVE-2026-53435 →CVE-2026-54512 →CVE-2026-56624 →CVE-2026-68494 →

📋 Description

CVE-2024-29371 — jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression CVE-2025-14813 — bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly CVE-2025-67030 — org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2026-0636 — bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java CVE-2026-1605 — org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests CVE-2026-2332 — org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing CVE-2026-3505 — bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion CVE-2026-5588 — bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid CVE-2026-40542 — httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification CVE-2026-41409 — Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix CVE-2026-41635 — Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass CVE-2026-42778 — Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) CVE-2026-42779 — Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass CVE-2026-47065 — mina: mina: Arbitrary Code Execution via Deserialization Bypass CVE-2026-50193 — jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing CVE-2026-53435 — jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration CVE-2026-53437 — jenkins: Jenkins: Phishing attack via improper redirect URL validation CVE-2026-54399 — org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers CVE-2026-54428 — org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks CVE-2026-54512 — jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass CVE-2026-56624 — org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation CVE-2026-57280 — jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution CVE-2026-57281 — jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox CVE-2026-68494 — com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser CVE-2026-70426 — jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass CVE-2026-70427 — jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links CVE-2026-70428 — jenkins: Jenkins: Arbitrary file write via path traversal CVE-2026-70429 — jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names

🎯 Affected products9

  • OpenShift Developer Tools and Services 4.21
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x as a component of OpenShift Developer Tools and Services 4.21
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le as a component of OpenShift Developer Tools and Services 4.21
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 as a component of OpenShift Developer Tools and Services 4.21
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 as a component of OpenShift Developer Tools and Services 4.21
  • registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x as a component of OpenShift Developer Tools and Services 4.21
  • registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 as a component of OpenShift Developer Tools and Services 4.21
  • registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 as a component of OpenShift Developer Tools and Services 4.21
  • registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le as a component of OpenShift Developer Tools and Services 4.21

✅ Remediation

It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed. Workaround: To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion. Workaround: To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed. Workaround: To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect. Workaround: Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller's file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes. Workaround: To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller's file system for any unauthorized write operations, which could indicate an attempted exploitation. Workaround: Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.

🔗 References (33)