RHSA-2026:60259HighCVSS 9.8

Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.

Published
August 26, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (28)

CVE-2025-67030 →CVE-2026-1605 →CVE-2026-3505 →CVE-2026-42778 →CVE-2026-47065 →CVE-2026-54399 →CVE-2026-70426 →CVE-2026-70429 →CVE-2026-41635 →CVE-2026-50193 →CVE-2026-68494 →CVE-2026-70428 →CVE-2026-5588 →CVE-2026-40542 →CVE-2026-41409 →CVE-2026-42779 →CVE-2026-54428 →CVE-2026-57280 →CVE-2026-57281 →CVE-2026-70427 →CVE-2024-29371 →CVE-2025-14813 →CVE-2026-0636 →CVE-2026-2332 →CVE-2026-53435 →CVE-2026-53437 →CVE-2026-54512 →CVE-2026-56624 →

📋 Description

CVE-2024-29371 — jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression CVE-2025-14813 — bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly CVE-2025-67030 — org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2026-0636 — bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java CVE-2026-1605 — org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests CVE-2026-2332 — org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing CVE-2026-3505 — bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion CVE-2026-5588 — bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid CVE-2026-40542 — httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification CVE-2026-41409 — Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix CVE-2026-41635 — Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass CVE-2026-42778 — Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) CVE-2026-42779 — Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass CVE-2026-47065 — mina: mina: Arbitrary Code Execution via Deserialization Bypass CVE-2026-50193 — jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing CVE-2026-53435 — jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration CVE-2026-53437 — jenkins: Jenkins: Phishing attack via improper redirect URL validation CVE-2026-54399 — org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers CVE-2026-54428 — org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks CVE-2026-54512 — jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass CVE-2026-56624 — org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation CVE-2026-57280 — jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution CVE-2026-57281 — jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox CVE-2026-68494 — com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser CVE-2026-70426 — jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass CVE-2026-70427 — jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links CVE-2026-70428 — jenkins: Jenkins: Arbitrary file write via path traversal CVE-2026-70429 — jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names

🎯 Affected products9

  • OpenShift Developer Tools and Services 4.20
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x as a component of OpenShift Developer Tools and Services 4.20
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le as a component of OpenShift Developer Tools and Services 4.20
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 as a component of OpenShift Developer Tools and Services 4.20
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 as a component of OpenShift Developer Tools and Services 4.20
  • registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le as a component of OpenShift Developer Tools and Services 4.20
  • registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 as a component of OpenShift Developer Tools and Services 4.20
  • registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 as a component of OpenShift Developer Tools and Services 4.20
  • registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x as a component of OpenShift Developer Tools and Services 4.20

✅ Remediation

It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed. Workaround: To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion. Workaround: To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect. Workaround: Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller's file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes. Workaround: To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller's file system for any unauthorized write operations, which could indicate an attempted exploitation. Workaround: Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.

🔗 References (33)