Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2022-30952
Vulnerability from cvelistv5
▼ | URL | Tags | |
---|---|---|---|
jenkinsci-cert@googlegroups.com | http://www.openwall.com/lists/oss-security/2022/05/17/8 | Mailing List, Third Party Advisory | |
jenkinsci-cert@googlegroups.com | https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714 | Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2022/05/17/8 | Mailing List, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714 | Vendor Advisory |
Vendor | Product | Version | |
---|---|---|---|
▼ | Jenkins project | Jenkins Pipeline SCM API for Blue Ocean Plugin |
Version: unspecified < |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T07:03:39.865Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" }, { "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins", "tags": [ "mailing-list", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Jenkins Pipeline SCM API for Blue Ocean Plugin", "vendor": "Jenkins project", "versions": [ { "lessThanOrEqual": "1.25.3", "status": "affected", "version": "unspecified", "versionType": "custom" }, { "status": "unaffected", "version": "1.25.0.1" } ] } ], "descriptions": [ { "lang": "en", "value": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins." } ], "providerMetadata": { "dateUpdated": "2023-10-24T14:21:47.422Z", "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins" }, "references": [ { "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" }, { "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins", "tags": [ "mailing-list" ], "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8" } ] } }, "cveMetadata": { "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2022-30952", "datePublished": "2022-05-17T00:00:00", "dateReserved": "2022-05-16T00:00:00", "dateUpdated": "2024-08-03T07:03:39.865Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-30952\",\"sourceIdentifier\":\"jenkinsci-cert@googlegroups.com\",\"published\":\"2022-05-17T15:15:09.293\",\"lastModified\":\"2024-11-21T07:03:37.153\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.\"},{\"lang\":\"es\",\"value\":\"La API SCM de Jenkins Pipeline para el plugin Blue Ocean versiones 1.25.3 y anteriores, permite a atacantes con permiso de Job/Configure acceder a credenciales con IDs especificados por el atacante almacenados en los almacenes privados de credenciales por usuario de cualquier usuario especificado por el atacante en Jenkins\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"baseScore\":4.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-522\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jenkins:blue_ocean:*:*:*:*:*:jenkins:*:*\",\"versionEndIncluding\":\"1.25.3\",\"matchCriteriaId\":\"1D6BC346-FCBF-49C9-BDF5-2A3B42429978\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2022/05/17/8\",\"source\":\"jenkinsci-cert@googlegroups.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714\",\"source\":\"jenkinsci-cert@googlegroups.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2022/05/17/8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
ghsa-g74w-93cp-5p3p
Vulnerability from github
When pipelines are created using the pipeline creation wizard in Blue Ocean, the credentials used are stored in the per-user credentials store of the user creating the pipeline. To allow pipelines to use this credential to scan repositories and checkout from SCM, the Blue Ocean Credentials Provider allows pipelines to access a specific credential from the per-user credentials store in Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier.
As a result, attackers with Job/Configure permission can rewrite job configurations in a way that lets them access and capture any attacker-specified credential from any user’s private credentials store.
Pipeline SCM API for Blue Ocean Plugin 1.25.4 deprecates the Blue Ocean Credentials Provider and disables it by default. As a result, all jobs initially set up using the Blue Ocean pipeline creation wizard and configured to use the credential specified at that time will no longer be able to access the credential, resulting in failures to scan repositories, checkout from SCM, etc. unless the repository is public and can be accessed without credentials.
This also applies to newly created pipelines after Pipeline SCM API for Blue Ocean Plugin has been updated to 1.25.4.
Administrators should reconfigure affected pipelines to use a credential from the Jenkins credential store or a folder credential store. See this help page on cloudbees.com to learn more.
To re-enable the Blue Ocean Credentials Provider, set the Java system property io.jenkins.blueocean.rest.impl.pipeline.credential.BlueOceanCredentialsProvider.enabled
to true
. Doing so is discouraged, as that will restore the unsafe behavior.
While Credentials Plugin provides the Configure Credential Providers UI to enable or disable certain credentials providers, enabling the Blue Ocean Credentials Provider there is not enough in Pipeline SCM API for Blue Ocean Plugin 1.25.4. Both the UI and system property need to enable the Blue Ocean Credentials Provider.
Administrators not immediately able to update Blue Ocean are advised to disable the Blue Ocean Credentials Provider through the UI at Manage Jenkins » Configure Credential Providers and to reconfigure affected pipelines to use a credential from the Jenkins credential store or a folder credential store.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "io.jenkins.blueocean:blueocean-pipeline-scm-api" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1.25.4" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2022-30952" ], "database_specific": { "cwe_ids": [ "CWE-522" ], "github_reviewed": true, "github_reviewed_at": "2022-06-02T14:57:49Z", "nvd_published_at": "2022-05-17T15:15:00Z", "severity": "MODERATE" }, "details": "When pipelines are created using the pipeline creation wizard in Blue Ocean, the credentials used are stored in the per-user credentials store of the user creating the pipeline. To allow pipelines to use this credential to scan repositories and checkout from SCM, the Blue Ocean Credentials Provider allows pipelines to access a specific credential from the per-user credentials store in Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier.\n\nAs a result, attackers with Job/Configure permission can rewrite job configurations in a way that lets them access and capture any attacker-specified credential from any user\u2019s private credentials store.\n\nPipeline SCM API for Blue Ocean Plugin 1.25.4 deprecates the Blue Ocean Credentials Provider and disables it by default. As a result, all jobs initially set up using the Blue Ocean pipeline creation wizard and configured to use the credential specified at that time will no longer be able to access the credential, resulting in failures to scan repositories, checkout from SCM, etc. unless the repository is public and can be accessed without credentials.\n\nThis also applies to newly created pipelines after Pipeline SCM API for Blue Ocean Plugin has been updated to 1.25.4.\n\nAdministrators should reconfigure affected pipelines to use a credential from the Jenkins credential store or a folder credential store. See [this help page on cloudbees.com](https://cloudbees.com/r/blue-ocean-credentials-removal) to learn more.\n\nTo re-enable the Blue Ocean Credentials Provider, set the Java system property `io.jenkins.blueocean.rest.impl.pipeline.credential.BlueOceanCredentialsProvider.enabled` to `true`. Doing so is discouraged, as that will restore the unsafe behavior.\n\nWhile Credentials Plugin provides the _Configure Credential Providers_ UI to enable or disable certain credentials providers, enabling the Blue Ocean Credentials Provider there is not enough in Pipeline SCM API for Blue Ocean Plugin 1.25.4. Both the UI and system property need to enable the Blue Ocean Credentials Provider.\n\nAdministrators not immediately able to update Blue Ocean are advised to disable the Blue Ocean Credentials Provider through the UI at _Manage Jenkins_ \u00bb _Configure Credential Providers_ and to reconfigure affected pipelines to use a credential from the Jenkins credential store or a folder credential store.", "id": "GHSA-g74w-93cp-5p3p", "modified": "2023-12-15T09:39:34Z", "published": "2022-05-18T00:00:40Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952" }, { "type": "WEB", "url": "https://github.com/jenkinsci/blueocean-plugin/commit/c4beeda0b574c297ac664511029feed0a15abaf1" }, { "type": "PACKAGE", "url": "https://github.com/jenkinsci/blueocean-plugin/tree/master/blueocean-pipeline-scm-api" }, { "type": "WEB", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "type": "CVSS_V3" } ], "summary": "Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin" }
WID-SEC-W-2023-0090
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterst\u00fctzung bei Softwareentwicklungen aller Art.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-0090 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2023-0090.json" }, { "category": "self", "summary": "WID-SEC-2023-0090 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0090" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3622 vom 2023-06-15", "url": "https://access.redhat.com/errata/RHSA-2023:3622" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3610 vom 2023-06-15", "url": "https://access.redhat.com/errata/RHSA-2023:3610" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3198 vom 2023-05-18", "url": "https://access.redhat.com/errata/RHSA-2023:3198" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1064 vom 2023-03-06", "url": "https://access.redhat.com/errata/RHSA-2023:1064" }, { "category": "external", "summary": "Jenkins Security Advisory vom 2022-05-17", "url": "https://www.jenkins.io/security/advisory/2022-05-17/" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0017 vom 2023-01-12", "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0560 vom 2023-02-08", "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0777 vom 2023-02-23", "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "source_lang": "en-US", "title": "Jenkins: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-06-15T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:09:39.972+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-0090", "initial_release_date": "2022-05-17T22:00:00.000+00:00", "revision_history": [ { "date": "2022-05-17T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-01-12T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-02-08T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-02-22T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-03-06T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-05-18T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-06-14T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-06-15T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Red Hat aufgenommen" } ], "status": "final", "version": "8" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Jenkins Jenkins", "product": { "name": "Jenkins Jenkins", "product_id": "T002196", "product_identification_helper": { "cpe": "cpe:/a:cloudbees:jenkins:-" } } } ], "category": "vendor", "name": "Jenkins" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } }, { "category": "product_name", "name": "Red Hat OpenShift container platform 4.0.51", "product": { "name": "Red Hat OpenShift container platform 4.0.51", "product_id": "T026183", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform_4.0.51" } } } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-2601", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2017-2601" }, { "cve": "CVE-2022-30945", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30945" }, { "cve": "CVE-2022-30946", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30946" }, { "cve": "CVE-2022-30947", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30947" }, { "cve": "CVE-2022-30948", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30948" }, { "cve": "CVE-2022-30949", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30949" }, { "cve": "CVE-2022-30950", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30950" }, { "cve": "CVE-2022-30951", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30951" }, { "cve": "CVE-2022-30952", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30952" }, { "cve": "CVE-2022-30953", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30953" }, { "cve": "CVE-2022-30954", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30954" }, { "cve": "CVE-2022-30955", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30955" }, { "cve": "CVE-2022-30956", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30956" }, { "cve": "CVE-2022-30957", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30957" }, { "cve": "CVE-2022-30958", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30958" }, { "cve": "CVE-2022-30959", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30959" }, { "cve": "CVE-2022-30960", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30960" }, { "cve": "CVE-2022-30961", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30961" }, { "cve": "CVE-2022-30962", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30962" }, { "cve": "CVE-2022-30963", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30963" }, { "cve": "CVE-2022-30964", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30964" }, { "cve": "CVE-2022-30965", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30965" }, { "cve": "CVE-2022-30966", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30966" }, { "cve": "CVE-2022-30967", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30967" }, { "cve": "CVE-2022-30968", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30968" }, { "cve": "CVE-2022-30969", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30969" }, { "cve": "CVE-2022-30970", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30970" }, { "cve": "CVE-2022-30971", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30971" }, { "cve": "CVE-2022-30972", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30972" } ] }
wid-sec-w-2023-0090
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterst\u00fctzung bei Softwareentwicklungen aller Art.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-0090 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2023-0090.json" }, { "category": "self", "summary": "WID-SEC-2023-0090 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0090" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3622 vom 2023-06-15", "url": "https://access.redhat.com/errata/RHSA-2023:3622" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3610 vom 2023-06-15", "url": "https://access.redhat.com/errata/RHSA-2023:3610" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3198 vom 2023-05-18", "url": "https://access.redhat.com/errata/RHSA-2023:3198" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1064 vom 2023-03-06", "url": "https://access.redhat.com/errata/RHSA-2023:1064" }, { "category": "external", "summary": "Jenkins Security Advisory vom 2022-05-17", "url": "https://www.jenkins.io/security/advisory/2022-05-17/" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0017 vom 2023-01-12", "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0560 vom 2023-02-08", "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0777 vom 2023-02-23", "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "source_lang": "en-US", "title": "Jenkins: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-06-15T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:09:39.972+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-0090", "initial_release_date": "2022-05-17T22:00:00.000+00:00", "revision_history": [ { "date": "2022-05-17T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-01-12T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-02-08T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-02-22T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-03-06T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-05-18T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-06-14T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-06-15T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Red Hat aufgenommen" } ], "status": "final", "version": "8" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Jenkins Jenkins", "product": { "name": "Jenkins Jenkins", "product_id": "T002196", "product_identification_helper": { "cpe": "cpe:/a:cloudbees:jenkins:-" } } } ], "category": "vendor", "name": "Jenkins" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } }, { "category": "product_name", "name": "Red Hat OpenShift container platform 4.0.51", "product": { "name": "Red Hat OpenShift container platform 4.0.51", "product_id": "T026183", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform_4.0.51" } } } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-2601", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2017-2601" }, { "cve": "CVE-2022-30945", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30945" }, { "cve": "CVE-2022-30946", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30946" }, { "cve": "CVE-2022-30947", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30947" }, { "cve": "CVE-2022-30948", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30948" }, { "cve": "CVE-2022-30949", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30949" }, { "cve": "CVE-2022-30950", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30950" }, { "cve": "CVE-2022-30951", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30951" }, { "cve": "CVE-2022-30952", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30952" }, { "cve": "CVE-2022-30953", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30953" }, { "cve": "CVE-2022-30954", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30954" }, { "cve": "CVE-2022-30955", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30955" }, { "cve": "CVE-2022-30956", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30956" }, { "cve": "CVE-2022-30957", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30957" }, { "cve": "CVE-2022-30958", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30958" }, { "cve": "CVE-2022-30959", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30959" }, { "cve": "CVE-2022-30960", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30960" }, { "cve": "CVE-2022-30961", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30961" }, { "cve": "CVE-2022-30962", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30962" }, { "cve": "CVE-2022-30963", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30963" }, { "cve": "CVE-2022-30964", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30964" }, { "cve": "CVE-2022-30965", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30965" }, { "cve": "CVE-2022-30966", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30966" }, { "cve": "CVE-2022-30967", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30967" }, { "cve": "CVE-2022-30968", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30968" }, { "cve": "CVE-2022-30969", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30969" }, { "cve": "CVE-2022-30970", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30970" }, { "cve": "CVE-2022-30971", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30971" }, { "cve": "CVE-2022-30972", "notes": [ { "category": "description", "text": "In Jenkins existieren mehrere Schwachstellen. Die Fehler sind in den folgenden Plugins vorhanden: Application Detector Plugin, Autocomplete Parameter Plugin, Blue Ocean Plugin, Git Plugin, GitLab Plugin, Global Variable String Parameter Plugin, JDK Parameter Plugin, Mercurial Plugin, Multiselect parameter Plugin, Pipeline SCM API for Blue Ocean Plugin, Pipeline: Groovy Plugin, Promoted Builds (Simple) Plugin, Random String Parameter Plugin, REPO Plugin, Rundeck Plugin, Script Security Plugin, Selection tasks Plugin, SSH Plugin, Storable Configs Plugin, vboxwrapper Plugin und das WMI Windows Agents Plugin. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren, vertrauliche Informationen offenzulegen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T026183", "67646", "T002196" ] }, "release_date": "2022-05-17T22:00:00Z", "title": "CVE-2022-30972" } ] }
rhsa-2023_0017
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat OpenShift Container Platform release 4.8.56 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.8.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.8.56. See the following advisory for the container images for this release:\n\nhttps://access.redhat.com/errata/RHBA-2023:0018\n\nSecurity Fix(es):\n\n* Pipeline Shared Groovy Libraries: Untrusted users can modify some\nPipeline libraries in Pipeline Shared Groovy Libraries Plugin\n(CVE-2022-29047)\n* Jenkins plugin: Sandbox bypass vulnerability through implicitly\nallowlisted platform Groovy files in Pipeline: Groovy Plugin\n(CVE-2022-30945)\n* Jenkins plugin: Mercurial SCM plugin can check out from the controller\nfile system (CVE-2022-30948)\n* jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step\nPlugin (CVE-2022-34177)\n* jenkins-plugin: Man-in-the-Middle (MitM) in\norg.jenkins-ci.plugins:git-client (CVE-2022-36881)\n* http2-server: Invalid HTTP/2 requests cause DoS (CVE-2022-2048)\n* Jenkins plugin: CSRF vulnerability in Script Security Plugin\n(CVE-2022-30946)\n* Jenkins plugin: User-scoped credentials exposed to other users by\nPipeline SCM API for Blue Ocean Plugin (CVE-2022-30952)\n* Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)\n* Jenkins plugin: missing permission checks in Blue Ocean Plugin\n(CVE-2022-30954)\n* jenkins: Observable timing discrepancy allows determining username\nvalidity (CVE-2022-34174)\n* jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin\n(CVE-2022-34176)\n* jenkins-plugin: Cross-site Request Forgery (CSRF) in\norg.jenkins-ci.plugins:git (CVE-2022-36882)\n* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook\n(CVE-2022-36883)\n* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook\n(CVE-2022-36884)\n* jenkins plugin: Non-constant time webhook signature comparison in GitHub\nPlugin (CVE-2022-36885)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s)\nlisted in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0017", "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2074855", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074855" }, { "category": "external", "summary": "2103548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103548" }, { "category": "external", "summary": "2103551", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103551" }, { "category": "external", "summary": "2114755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2114755" }, { "category": "external", "summary": "2116840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116840" }, { "category": "external", "summary": "2116952", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116952" }, { "category": "external", "summary": "2119642", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119642" }, { "category": "external", "summary": "2119643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119643" }, { "category": "external", "summary": "2119644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119644" }, { "category": "external", "summary": "2119645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "category": "external", "summary": "2119646", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119646" }, { "category": "external", "summary": "2119647", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119647" }, { "category": "external", "summary": "2119653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119653" }, { "category": "external", "summary": "2119656", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119656" }, { "category": "external", "summary": "2119657", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119657" }, { "category": "external", "summary": "2119658", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119658" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0017.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update", "tracking": { "current_release_date": "2024-11-22T21:22:11+00:00", "generator": { "date": "2024-11-22T21:22:11+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:0017", "initial_release_date": "2023-01-12T16:49:54+00:00", "revision_history": [ { "date": "2023-01-12T16:49:54+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-01-12T16:49:54+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T21:22:11+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.8", "product": { "name": "Red Hat OpenShift Container Platform 4.8", "product_id": "8Base-RHOSE-4.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.8::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "jenkins-0:2.361.1.1672840472-1.el8.src", "product": { "name": "jenkins-0:2.361.1.1672840472-1.el8.src", "product_id": "jenkins-0:2.361.1.1672840472-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.361.1.1672840472-1.el8?arch=src" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src", "product": { "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src", "product_id": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.8.1672842762-1.el8?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jenkins-0:2.361.1.1672840472-1.el8.noarch", "product": { "name": "jenkins-0:2.361.1.1672840472-1.el8.noarch", "product_id": "jenkins-0:2.361.1.1672840472-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.361.1.1672840472-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "product": { "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "product_id": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.8.1672842762-1.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.361.1.1672840472-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.8", "product_id": "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch" }, "product_reference": "jenkins-0:2.361.1.1672840472-1.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.8" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.361.1.1672840472-1.el8.src as a component of Red Hat OpenShift Container Platform 4.8", "product_id": "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" }, "product_reference": "jenkins-0:2.361.1.1672840472-1.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.8" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.8", "product_id": "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch" }, "product_reference": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.8" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src as a component of Red Hat OpenShift Container Platform 4.8", "product_id": "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" }, "product_reference": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-2048", "cwe": { "id": "CWE-410", "name": "Insufficient Resource Pool" }, "discovery_date": "2022-08-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2116952" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Eclipse Jetty http2-server package. This flaw allows an attacker to cause a denial of service in the server via HTTP/2 requests.", "title": "Vulnerability description" }, { "category": "summary", "text": "http2-server: Invalid HTTP/2 requests cause DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2048" }, { "category": "external", "summary": "RHBZ#2116952", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116952" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2048", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2048" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2048", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2048" }, { "category": "external", "summary": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j", "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j" } ], "release_date": "2022-07-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "http2-server: Invalid HTTP/2 requests cause DoS" }, { "cve": "CVE-2022-29047", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2022-04-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2074855" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Jenkins Pipeline: Shared Groovy Libraries plugin. The Jenkins Pipeline: Shared Groovy Libraries plugin allows attackers to submit pull requests. However, the attacker cannot commit directly to the configured Source Control Management (SCM) to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even with the Pipeline configured not to trust them.", "title": "Vulnerability description" }, { "category": "summary", "text": "Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-29047" }, { "category": "external", "summary": "RHBZ#2074855", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074855" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29047" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951", "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951" } ], "release_date": "2022-04-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin" }, { "cve": "CVE-2022-30945", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119642" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jenkins Groovy Plugin. The plugin allows pipelines to load Groovy source files. The intent is to allow Global Shared Libraries to execute without sandbox protection. The issue is that the plugin allows any Groovy source files bundled with Jenkins core and plugins to be loaded this way and their methods executed. If a suitable Groovy source file is available on the classpath of Jenkins, sandbox protections can be bypassed. No Groovy source files were found in Jenkins core or plugins that could result in attackers executing dangerous code; hence successful exploitation is considered highly unlikely.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Pipeline: Groovy Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30945" }, { "category": "external", "summary": "RHBZ#2119642", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119642" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30945", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30945" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30945", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30945" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "plugin: Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Pipeline: Groovy Plugin" }, { "cve": "CVE-2022-30946", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119643" } ], "notes": [ { "category": "description", "text": "A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: CSRF vulnerability in Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30946" }, { "category": "external", "summary": "RHBZ#2119643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119643" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30946", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30946" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30946", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30946" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: CSRF vulnerability in Script Security Plugin" }, { "cve": "CVE-2022-30948", "cwe": { "id": "CWE-435", "name": "Improper Interaction Between Multiple Correctly-Behaving Entities" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119644" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Jenkins plugin. Affected versions of the Jenkins Mercurial Plugin allow attackers who can configure pipelines to check out some SCM repositories stored on the Jenkins controller\u0027s file system. This is accomplished by using local paths as SCM URLs, obtaining limited information about other projects\u0027 SCM contents.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Mercurial SCM plugin can check out from the controller file system", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30948" }, { "category": "external", "summary": "RHBZ#2119644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119644" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30948", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30948" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30948", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30948" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "plugin: Mercurial SCM plugin can check out from the controller file system" }, { "cve": "CVE-2022-30952", "cwe": { "id": "CWE-668", "name": "Exposure of Resource to Wrong Sphere" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119645" } ], "notes": [ { "category": "description", "text": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30952" }, { "category": "external", "summary": "RHBZ#2119645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30952", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30952" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin" }, { "cve": "CVE-2022-30953", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119646" } ], "notes": [ { "category": "description", "text": "A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: CSRF vulnerability in Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30953" }, { "category": "external", "summary": "RHBZ#2119646", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119646" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30953", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30953" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30953", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30953" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: CSRF vulnerability in Blue Ocean Plugin" }, { "cve": "CVE-2022-30954", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119647" } ], "notes": [ { "category": "description", "text": "Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: missing permission checks in Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30954" }, { "category": "external", "summary": "RHBZ#2119647", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119647" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30954", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30954" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30954", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30954" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: missing permission checks in Blue Ocean Plugin" }, { "cve": "CVE-2022-34174", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119653" } ], "notes": [ { "category": "description", "text": "In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins: Observable timing discrepancy allows determining username validity", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-34174" }, { "category": "external", "summary": "RHBZ#2119653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119653" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-34174", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34174" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34174", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34174" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566", "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566" } ], "release_date": "2022-06-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins: Observable timing discrepancy allows determining username validity" }, { "cve": "CVE-2022-34176", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2022-07-04T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2103548" } ], "notes": [ { "category": "description", "text": "A flaw was found in the JUnit Jenkins plugin. The manipulation with an unknown input leads to a Cross-site scripting vulnerability, impacting the integrity. This flaw allows an attacker to inject arbitrary HTML and script code into the website.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-34176" }, { "category": "external", "summary": "RHBZ#2103548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103548" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-34176", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34176" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34176", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34176" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760", "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760" } ], "release_date": "2022-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin" }, { "cve": "CVE-2022-34177", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-07-04T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2103551" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Pipeline Input Step Plugin. This issue affects the code of the component Archive File Handler. The manipulation of the argument file with a malicious input leads to a directory traversal vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-34177" }, { "category": "external", "summary": "RHBZ#2103551", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103551" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-34177", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34177" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34177", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34177" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2705", "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2705" } ], "release_date": "2022-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin" }, { "cve": "CVE-2022-36881", "cwe": { "id": "CWE-322", "name": "Key Exchange without Entity Authentication" }, "discovery_date": "2022-08-03T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2114755" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36881" }, { "category": "external", "summary": "RHBZ#2114755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2114755" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36881" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-cm7j-p8hc-97vj", "url": "https://github.com/advisories/GHSA-cm7j-p8hc-97vj" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468" } ], "release_date": "2022-08-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client" }, { "cve": "CVE-2022-36882", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "discovery_date": "2022-08-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2116840" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Git Jenkins plugin. The affected versions of the Git Jenkins Plugin allow attackers to trigger the builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36882" }, { "category": "external", "summary": "RHBZ#2116840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116840" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36882", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36882" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36882", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36882" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" } ], "release_date": "2022-08-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git" }, { "cve": "CVE-2022-36883", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119656" } ], "notes": [ { "category": "description", "text": "A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Lack of authentication mechanism in Git Plugin webhook", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36883" }, { "category": "external", "summary": "RHBZ#2119656", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119656" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36883", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36883" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36883", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36883" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" } ], "release_date": "2022-07-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: Lack of authentication mechanism in Git Plugin webhook" }, { "cve": "CVE-2022-36884", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119657" } ], "notes": [ { "category": "description", "text": "The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Lack of authentication mechanism in Git Plugin webhook", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36884" }, { "category": "external", "summary": "RHBZ#2119657", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119657" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36884", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36884" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36884", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36884" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" } ], "release_date": "2022-07-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: Lack of authentication mechanism in Git Plugin webhook" }, { "cve": "CVE-2022-36885", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119658" } ], "notes": [ { "category": "description", "text": "Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Non-constant time webhook signature comparison in GitHub Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36885" }, { "category": "external", "summary": "RHBZ#2119658", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119658" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36885", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36885" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849" } ], "release_date": "2022-07-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: Non-constant time webhook signature comparison in GitHub Plugin" } ] }
rhsa-2023_0777
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat OpenShift Container Platform release 4.9.56 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.9.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\n\nThis advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.9.56. See the following advisory for the container images for this release:\n\nhttps://access.redhat.com/errata/RHSA-2023:0778\n\nSecurity Fix(es):\n\n* jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin (CVE-2022-43401)\n\n* jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin (CVE-2022-43402)\n\n* jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin (CVE-2022-43403)\n\n* jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin (CVE-2022-43404)\n\n* jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin (CVE-2022-43405)\n\n* jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin (CVE-2022-43406)\n\n* google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization (CVE-2020-7692)\n\n* SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n\n* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)\n\n* jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin (CVE-2022-43407)\n\n* mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n\n* jenkins-plugin/script-security: Whole-script approval in Script Security Plugin vulnerable to SHA-1 collisions (CVE-2022-45379)\n\n* jenkins-plugin/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2022-45380)\n\n* jenkins-plugin/pipeline-utility-steps: Arbitrary file read vulnerability in Pipeline Utility Steps Plugin (CVE-2022-45381)\n\n* http2-server: Invalid HTTP/2 requests cause DoS (CVE-2022-2048)\n\n* Jenkins plugin: CSRF vulnerability in Script Security Plugin (CVE-2022-30946)\n\n* Jenkins plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin (CVE-2022-30952)\n\n* Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)\n\n* Jenkins plugin: missing permission checks in Blue Ocean Plugin (CVE-2022-30954)\n\n* jenkins: Observable timing discrepancy allows determining username validity (CVE-2022-34174)\n\n* jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git (CVE-2022-36882)\n\n* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook (CVE-2022-36883)\n\n* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook (CVE-2022-36884)\n\n* jenkins plugin: Non-constant time webhook signature comparison in GitHub Plugin (CVE-2022-36885)\n\n* jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin (CVE-2022-43408)\n\n* jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin (CVE-2022-43409)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAll OpenShift Container Platform 4.9 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.9/updating/updating-cluster-cli.html", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0777", "url": "https://access.redhat.com/errata/RHSA-2023:0777" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "url": "https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html" }, { "category": "external", "summary": "1856376", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856376" }, { "category": "external", "summary": "2116840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116840" }, { "category": "external", "summary": "2116952", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116952" }, { "category": "external", "summary": "2119643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119643" }, { "category": "external", "summary": "2119645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "category": "external", "summary": "2119646", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119646" }, { "category": "external", "summary": "2119647", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119647" }, { "category": "external", "summary": "2119653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119653" }, { "category": "external", "summary": "2119656", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119656" }, { "category": "external", "summary": "2119657", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119657" }, { "category": "external", "summary": "2119658", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119658" }, { "category": "external", "summary": "2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "2136370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136370" }, { "category": "external", "summary": "2136374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136374" }, { "category": "external", "summary": "2136379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136379" }, { "category": "external", "summary": "2136381", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136381" }, { "category": "external", "summary": "2136382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136382" }, { "category": "external", "summary": "2136383", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136383" }, { "category": "external", "summary": "2136386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136386" }, { "category": "external", "summary": "2136388", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136388" }, { "category": "external", "summary": "2136391", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136391" }, { "category": "external", "summary": "2143086", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143086" }, { "category": "external", "summary": "2143089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143089" }, { "category": "external", "summary": "2143090", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143090" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0777.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 4.9.56 security update", "tracking": { "current_release_date": "2024-12-17T23:01:39+00:00", "generator": { "date": "2024-12-17T23:01:39+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHSA-2023:0777", "initial_release_date": "2023-02-23T00:01:27+00:00", "revision_history": [ { "date": "2023-02-23T00:01:27+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-02-23T00:01:27+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-17T23:01:39+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.9", "product": { "name": "Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.9::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "jenkins-0:2.361.1.1675668150-1.el8.src", "product": { "name": "jenkins-0:2.361.1.1675668150-1.el8.src", "product_id": "jenkins-0:2.361.1.1675668150-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.361.1.1675668150-1.el8?arch=src" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.9.1675668922-1.el8.src", "product": { "name": "jenkins-2-plugins-0:4.9.1675668922-1.el8.src", "product_id": "jenkins-2-plugins-0:4.9.1675668922-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.9.1675668922-1.el8?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jenkins-0:2.361.1.1675668150-1.el8.noarch", "product": { "name": "jenkins-0:2.361.1.1675668150-1.el8.noarch", "product_id": "jenkins-0:2.361.1.1675668150-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.361.1.1675668150-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "product": { "name": "jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "product_id": "jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.9.1675668922-1.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.361.1.1675668150-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch" }, "product_reference": "jenkins-0:2.361.1.1675668150-1.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.361.1.1675668150-1.el8.src as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" }, "product_reference": "jenkins-0:2.361.1.1675668150-1.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch" }, "product_reference": "jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.9.1675668922-1.el8.src as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" }, "product_reference": "jenkins-2-plugins-0:4.9.1675668922-1.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.9" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-7692", "cwe": { "id": "CWE-358", "name": "Improperly Implemented Security Check for Standard" }, "discovery_date": "2020-07-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1856376" } ], "notes": [ { "category": "description", "text": "PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.", "title": "Vulnerability description" }, { "category": "summary", "text": "google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7692" }, { "category": "external", "summary": "RHBZ#1856376", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856376" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7692", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7692" } ], "release_date": "2020-07-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization" }, { "cve": "CVE-2022-1471", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-12-01T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150009" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "SnakeYaml: Constructor Deserialization Remote Code Execution", "title": "Vulnerability summary" }, { "category": "other", "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1471" }, { "category": "external", "summary": "RHBZ#2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, { "category": "external", "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2", "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "SnakeYaml: Constructor Deserialization Remote Code Execution" }, { "cve": "CVE-2022-2048", "cwe": { "id": "CWE-410", "name": "Insufficient Resource Pool" }, "discovery_date": "2022-08-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2116952" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Eclipse Jetty http2-server package. This flaw allows an attacker to cause a denial of service in the server via HTTP/2 requests.", "title": "Vulnerability description" }, { "category": "summary", "text": "http2-server: Invalid HTTP/2 requests cause DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2048" }, { "category": "external", "summary": "RHBZ#2116952", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116952" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2048", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2048" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2048", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2048" }, { "category": "external", "summary": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j", "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j" } ], "release_date": "2022-07-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "http2-server: Invalid HTTP/2 requests cause DoS" }, { "cve": "CVE-2022-25857", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-09-14T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2126789" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Denial of Service due to missing nested depth limitation for collections", "title": "Vulnerability summary" }, { "category": "other", "text": "For RHEL-8 it\u0027s downgraded to moderate because \"snakeyaml\" itself in RHEL 8 or RHEL-9 isn\u0027t shipped and \"prometheus-jmx-exporter\" is needed as build dependency. And it\u0027s not directly exploitable, hence severity marked as moderate.\nRed Hat Integration and AMQ products are not vulnerable to this flaw, so their severity has been lowered to moderate.\nRed Hat Single Sign-On uses snakeyaml from liquibase-core and is only used when performing migrations and would require administrator privileges to execute, hence severity marked as Low.\nRed Hat Fuse 7 is now in Maintenance Support Phase and details about its fix should be present soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25857" }, { "category": "external", "summary": "RHBZ#2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25857", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25857" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" }, { "category": "external", "summary": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525", "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525" } ], "release_date": "2022-08-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "snakeyaml: Denial of Service due to missing nested depth limitation for collections" }, { "cve": "CVE-2022-30946", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119643" } ], "notes": [ { "category": "description", "text": "A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: CSRF vulnerability in Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30946" }, { "category": "external", "summary": "RHBZ#2119643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119643" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30946", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30946" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30946", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30946" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: CSRF vulnerability in Script Security Plugin" }, { "cve": "CVE-2022-30952", "cwe": { "id": "CWE-668", "name": "Exposure of Resource to Wrong Sphere" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119645" } ], "notes": [ { "category": "description", "text": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30952" }, { "category": "external", "summary": "RHBZ#2119645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30952", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30952" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin" }, { "cve": "CVE-2022-30953", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119646" } ], "notes": [ { "category": "description", "text": "A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: CSRF vulnerability in Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30953" }, { "category": "external", "summary": "RHBZ#2119646", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119646" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30953", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30953" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30953", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30953" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: CSRF vulnerability in Blue Ocean Plugin" }, { "cve": "CVE-2022-30954", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119647" } ], "notes": [ { "category": "description", "text": "Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: missing permission checks in Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30954" }, { "category": "external", "summary": "RHBZ#2119647", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119647" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30954", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30954" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30954", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30954" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: missing permission checks in Blue Ocean Plugin" }, { "cve": "CVE-2022-34174", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119653" } ], "notes": [ { "category": "description", "text": "In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins: Observable timing discrepancy allows determining username validity", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-34174" }, { "category": "external", "summary": "RHBZ#2119653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119653" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-34174", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34174" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34174", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34174" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566", "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566" } ], "release_date": "2022-06-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins: Observable timing discrepancy allows determining username validity" }, { "cve": "CVE-2022-36882", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "discovery_date": "2022-08-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2116840" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Git Jenkins plugin. The affected versions of the Git Jenkins Plugin allow attackers to trigger the builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36882" }, { "category": "external", "summary": "RHBZ#2116840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116840" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36882", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36882" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36882", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36882" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" } ], "release_date": "2022-08-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git" }, { "cve": "CVE-2022-36883", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119656" } ], "notes": [ { "category": "description", "text": "A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Lack of authentication mechanism in Git Plugin webhook", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36883" }, { "category": "external", "summary": "RHBZ#2119656", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119656" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36883", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36883" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36883", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36883" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" } ], "release_date": "2022-07-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: Lack of authentication mechanism in Git Plugin webhook" }, { "cve": "CVE-2022-36884", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119657" } ], "notes": [ { "category": "description", "text": "The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Lack of authentication mechanism in Git Plugin webhook", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36884" }, { "category": "external", "summary": "RHBZ#2119657", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119657" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36884", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36884" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36884", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36884" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" } ], "release_date": "2022-07-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: Lack of authentication mechanism in Git Plugin webhook" }, { "cve": "CVE-2022-36885", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119658" } ], "notes": [ { "category": "description", "text": "Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Non-constant time webhook signature comparison in GitHub Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36885" }, { "category": "external", "summary": "RHBZ#2119658", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119658" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36885", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36885" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849" } ], "release_date": "2022-07-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: Non-constant time webhook signature comparison in GitHub Plugin" }, { "cve": "CVE-2022-43401", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136381" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43401" }, { "category": "external", "summary": "RHBZ#2136381", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136381" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43401", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43401" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43401", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43401" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin" }, { "cve": "CVE-2022-43402", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136379" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43402" }, { "category": "external", "summary": "RHBZ#2136379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136379" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43402", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43402" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43402", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43402" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin" }, { "cve": "CVE-2022-43403", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136382" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43403" }, { "category": "external", "summary": "RHBZ#2136382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43403", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43403" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43403", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43403" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin" }, { "cve": "CVE-2022-43404", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136383" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43404" }, { "category": "external", "summary": "RHBZ#2136383", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136383" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43404", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43404" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43404", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43404" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin" }, { "cve": "CVE-2022-43405", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136374" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43405" }, { "category": "external", "summary": "RHBZ#2136374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43405", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43405" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43405", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43405" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin" }, { "cve": "CVE-2022-43406", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136370" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43406" }, { "category": "external", "summary": "RHBZ#2136370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136370" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43406", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43406" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43406", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43406" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin" }, { "cve": "CVE-2022-43407", "cwe": { "id": "CWE-838", "name": "Inappropriate Encoding for Output Context" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136386" } ], "notes": [ { "category": "description", "text": "A cross-site request forgery (CSRF) vulnerability was found in a Jenkins plugin. This issue may allow an unauthenticated attacker to access Jenkins builds, bypassing CSRF protections. This could compromise the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43407" }, { "category": "external", "summary": "RHBZ#2136386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43407", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43407" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43407", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43407" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin" }, { "cve": "CVE-2022-43408", "cwe": { "id": "CWE-838", "name": "Inappropriate Encoding for Output Context" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136388" } ], "notes": [ { "category": "description", "text": "A Cross-site request forgery (CSRF) vulnerability was found in a Jenkins plugin. This issue may allow an authenticated attacker to access Jenkins builds, bypassing CSRF protections.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43408" }, { "category": "external", "summary": "RHBZ#2136388", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136388" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43408", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43408" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43408", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43408" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin" }, { "cve": "CVE-2022-43409", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136391" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability was found in a Jenkins plugin. This issue may allow an authenticated remote attacker to create Pipelines.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43409" }, { "category": "external", "summary": "RHBZ#2136391", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136391" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43409", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43409" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43409", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43409" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45379", "cwe": { "id": "CWE-328", "name": "Use of Weak Hash" }, "discovery_date": "2022-11-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2143090" } ], "notes": [ { "category": "description", "text": "A flaw was found in the script-security Jenkins Plugin. SHA-1 no longer meets the security standards for producing a cryptographically secure message digest. The affected version of the script-security Plugin stores whole-script approvals as the SHA-1 hash of the approved script.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Whole-script approval in Script Security Plugin vulnerable to SHA-1 collisions", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift 3.11 is already in the ELS support model phase. The Jenkins components are out of scope of the ELS support; hence OpenShift 3.11 Jenkins component is marked in this CVE as out of support scope.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45379" }, { "category": "external", "summary": "RHBZ#2143090", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143090" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45379", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45379" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45379", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45379" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2564", "url": "https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2564" } ], "release_date": "2022-11-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin/script-security: Whole-script approval in Script Security Plugin vulnerable to SHA-1 collisions" }, { "cve": "CVE-2022-45380", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2022-11-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2143086" } ], "notes": [ { "category": "description", "text": "A flaw was found in the JUnit Jenkins Plugin. The affected version of the JUnit plugin converts HTTP(S) URLs in test report output to clickable links, which leads to a stored Cross-site scripting (XSS) attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/JUnit: Stored XSS vulnerability in JUnit Plugin", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift 3.11 is already in the ELS support model phase. The Jenkins components are out of scope of the ELS support; hence OpenShift 3.11 Jenkins component is marked in this CVE as Out of Support Scope.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45380" }, { "category": "external", "summary": "RHBZ#2143086", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143086" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45380", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45380" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45380", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45380" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2888", "url": "https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2888" } ], "release_date": "2022-11-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin/JUnit: Stored XSS vulnerability in JUnit Plugin" }, { "cve": "CVE-2022-45381", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-11-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2143089" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Pipeline Utility Steps Jenkins Plugin. The affected version of the Pipeline Utility Steps Plugin does not restrict the set of enabled prefix interpolators and bundles versions of this library that enable the file: prefix interpolator by default. This flaw allows attackers who can configure Pipelines to read arbitrary files from the Jenkins controller file system.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-utility-steps: Arbitrary file read vulnerability in Pipeline Utility Steps Plugin", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift 3.11 is already in the ELS support model phase. The Jenkins components are out of scope of the ELS support; hence the OpenShift 3.11 Jenkins component is marked in this CVE as out of support scope.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45381" }, { "category": "external", "summary": "RHBZ#2143089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143089" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45381", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45381" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45381", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45381" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2949", "url": "https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2949" } ], "release_date": "2022-11-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-23T00:01:27+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.361.1.1675668150-1.el8.src", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1675668922-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin/pipeline-utility-steps: Arbitrary file read vulnerability in Pipeline Utility Steps Plugin" } ] }
rhsa-2023_1064
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for Jenkins and Jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.12.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron.\n\nSecurity Fix(es):\n\n* jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin (CVE-2022-43401)\n\n* jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin (CVE-2022-43402)\n\n* jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin (CVE-2022-43403)\n\n* jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin (CVE-2022-43404)\n\n* jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin (CVE-2022-43405)\n\n* jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin (CVE-2022-43406)\n\n* Pipeline Shared Groovy Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin (CVE-2022-29047)\n\n* jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin (CVE-2022-43407)\n\n* mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n\n* Jenkins plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin (CVE-2022-30952)\n\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n\n* jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin (CVE-2022-43408)\n\n* jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin (CVE-2022-43409)\n\n* jenkins-plugin/mercurial: Webhook endpoint discloses job names to unauthorized users in Mercurial Plugin (CVE-2022-43410)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1064", "url": "https://access.redhat.com/errata/RHSA-2023:1064" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "2074855", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074855" }, { "category": "external", "summary": "2119645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2136369", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136369" }, { "category": "external", "summary": "2136370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136370" }, { "category": "external", "summary": "2136374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136374" }, { "category": "external", "summary": "2136379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136379" }, { "category": "external", "summary": "2136381", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136381" }, { "category": "external", "summary": "2136382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136382" }, { "category": "external", "summary": "2136383", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136383" }, { "category": "external", "summary": "2136386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136386" }, { "category": "external", "summary": "2136388", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136388" }, { "category": "external", "summary": "2136391", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136391" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1064.json" } ], "title": "Red Hat Security Advisory: OpenShift Developer Tools and Services for OCP 4.12 security update", "tracking": { "current_release_date": "2024-12-10T17:45:19+00:00", "generator": { "date": "2024-12-10T17:45:19+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHSA-2023:1064", "initial_release_date": "2023-03-06T09:01:46+00:00", "revision_history": [ { "date": "2023-03-06T09:01:46+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-06T09:01:46+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-10T17:45:19+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "OpenShift Developer Tools and Services for OCP 4.12", "product": { "name": "OpenShift Developer Tools and Services for OCP 4.12", "product_id": "8Base-OCP-Tools-4.12", "product_identification_helper": { "cpe": "cpe:/a:redhat:ocp_tools:4.12::el8" } } } ], "category": "product_family", "name": "OpenShift Jenkins" }, { "branches": [ { "category": "product_version", "name": "jenkins-0:2.361.4.1675702346-3.el8.src", "product": { "name": "jenkins-0:2.361.4.1675702346-3.el8.src", "product_id": "jenkins-0:2.361.4.1675702346-3.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.361.4.1675702346-3.el8?arch=src" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.12.1675702407-1.el8.src", "product": { "name": "jenkins-2-plugins-0:4.12.1675702407-1.el8.src", "product_id": "jenkins-2-plugins-0:4.12.1675702407-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.12.1675702407-1.el8?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jenkins-0:2.361.4.1675702346-3.el8.noarch", "product": { "name": "jenkins-0:2.361.4.1675702346-3.el8.noarch", "product_id": "jenkins-0:2.361.4.1675702346-3.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.361.4.1675702346-3.el8?arch=noarch" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "product": { "name": "jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "product_id": "jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.12.1675702407-1.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.361.4.1675702346-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.12", "product_id": "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch" }, "product_reference": "jenkins-0:2.361.4.1675702346-3.el8.noarch", "relates_to_product_reference": "8Base-OCP-Tools-4.12" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.361.4.1675702346-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.12", "product_id": "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" }, "product_reference": "jenkins-0:2.361.4.1675702346-3.el8.src", "relates_to_product_reference": "8Base-OCP-Tools-4.12" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.12", "product_id": "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch" }, "product_reference": "jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "relates_to_product_reference": "8Base-OCP-Tools-4.12" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.12.1675702407-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.12", "product_id": "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" }, "product_reference": "jenkins-2-plugins-0:4.12.1675702407-1.el8.src", "relates_to_product_reference": "8Base-OCP-Tools-4.12" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-29047", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2022-04-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2074855" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Jenkins Pipeline: Shared Groovy Libraries plugin. The Jenkins Pipeline: Shared Groovy Libraries plugin allows attackers to submit pull requests. However, the attacker cannot commit directly to the configured Source Control Management (SCM) to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even with the Pipeline configured not to trust them.", "title": "Vulnerability description" }, { "category": "summary", "text": "Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-29047" }, { "category": "external", "summary": "RHBZ#2074855", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074855" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29047" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951", "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951" } ], "release_date": "2022-04-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin" }, { "cve": "CVE-2022-30952", "cwe": { "id": "CWE-668", "name": "Exposure of Resource to Wrong Sphere" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119645" } ], "notes": [ { "category": "description", "text": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30952" }, { "category": "external", "summary": "RHBZ#2119645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30952", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30952" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-43401", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136381" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43401" }, { "category": "external", "summary": "RHBZ#2136381", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136381" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43401", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43401" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43401", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43401" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin" }, { "cve": "CVE-2022-43402", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136379" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43402" }, { "category": "external", "summary": "RHBZ#2136379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136379" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43402", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43402" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43402", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43402" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin" }, { "cve": "CVE-2022-43403", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136382" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43403" }, { "category": "external", "summary": "RHBZ#2136382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43403", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43403" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43403", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43403" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin" }, { "cve": "CVE-2022-43404", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136383" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43404" }, { "category": "external", "summary": "RHBZ#2136383", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136383" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43404", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43404" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43404", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43404" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin" }, { "cve": "CVE-2022-43405", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136374" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43405" }, { "category": "external", "summary": "RHBZ#2136374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43405", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43405" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43405", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43405" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin" }, { "cve": "CVE-2022-43406", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136370" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43406" }, { "category": "external", "summary": "RHBZ#2136370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136370" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43406", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43406" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43406", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43406" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin" }, { "cve": "CVE-2022-43407", "cwe": { "id": "CWE-838", "name": "Inappropriate Encoding for Output Context" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136386" } ], "notes": [ { "category": "description", "text": "A cross-site request forgery (CSRF) vulnerability was found in a Jenkins plugin. This issue may allow an unauthenticated attacker to access Jenkins builds, bypassing CSRF protections. This could compromise the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43407" }, { "category": "external", "summary": "RHBZ#2136386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43407", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43407" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43407", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43407" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin" }, { "cve": "CVE-2022-43408", "cwe": { "id": "CWE-838", "name": "Inappropriate Encoding for Output Context" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136388" } ], "notes": [ { "category": "description", "text": "A Cross-site request forgery (CSRF) vulnerability was found in a Jenkins plugin. This issue may allow an authenticated attacker to access Jenkins builds, bypassing CSRF protections.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43408" }, { "category": "external", "summary": "RHBZ#2136388", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136388" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43408", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43408" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43408", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43408" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin" }, { "cve": "CVE-2022-43409", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136391" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability was found in a Jenkins plugin. This issue may allow an authenticated remote attacker to create Pipelines.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43409" }, { "category": "external", "summary": "RHBZ#2136391", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136391" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43409", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43409" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43409", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43409" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin" }, { "cve": "CVE-2022-43410", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136369" } ], "notes": [ { "category": "description", "text": "An information leak was found in a Jenkins plugin. This issue could allow an unauthenticated remote attacker to issue GET requests. The greatest impact is to confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/mercurial: Webhook endpoint discloses job names to unauthorized users in Mercurial Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43410" }, { "category": "external", "summary": "RHBZ#2136369", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136369" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43410", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43410" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43410", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43410" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/mercurial: Webhook endpoint discloses job names to unauthorized users in Mercurial Plugin" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" } ] }
rhsa-2023_0560
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat OpenShift Container Platform release 4.10.51 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\n\nSecurity Fix(es):\n\n* jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins\nScript Security Plugin (CVE-2022-43401)\n* jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline:\nGroovy Plugin (CVE-2022-43402)\n* jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins\nScript Security Plugin (CVE-2022-43403)\n* jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins\nScript Security Plugin (CVE-2022-43404)\n* jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in\nPipeline: Groovy Libraries Plugin (CVE-2022-43405)\n* jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in\nPipeline: Deprecated Groovy Libraries Plugin (CVE-2022-43406)\n* google-oauth-client: missing PKCE support in accordance with the RFC for\nOAuth 2.0 for Native Apps can lead to improper authorization\n(CVE-2020-7692)\n* snakeyaml: Denial of Service due to missing nested depth limitation for\ncollections (CVE-2022-25857)\n* jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be\nbypassed in Pipeline: Input Step Plugin (CVE-2022-43407)\n* mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n* jenkins-plugin/script-security: Whole-script approval in Script Security\nPlugin vulnerable to SHA-1 collisions (CVE-2022-45379)\n* jenkins-plugin/JUnit: Stored XSS vulnerability in JUnit Plugin\n(CVE-2022-45380)\n* jenkins-plugin/pipeline-utility-steps: Arbitrary file read vulnerability\nin Pipeline Utility Steps Plugin (CVE-2022-45381)\n* Jenkins plugin: CSRF vulnerability in Script Security Plugin\n(CVE-2022-30946)\n* Jenkins plugin: User-scoped credentials exposed to other users by\nPipeline SCM API for Blue Ocean Plugin (CVE-2022-30952)\n* Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)\n* Jenkins plugin: missing permission checks in Blue Ocean Plugin\n(CVE-2022-30954)\n* jenkins-plugin: Cross-site Request Forgery (CSRF) in\norg.jenkins-ci.plugins:git (CVE-2022-36882)\n* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook\n(CVE-2022-36883)\n* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook\n(CVE-2022-36884)\n* jenkins plugin: Non-constant time webhook signature comparison in GitHub\nPlugin (CVE-2022-36885)\n* jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be\nbypassed in Pipeline: Stage View Plugin (CVE-2022-43408)\n* jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline:\nSupporting APIs Plugin (CVE-2022-43409)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0560", "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "1856376", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856376" }, { "category": "external", "summary": "2116840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116840" }, { "category": "external", "summary": "2119643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119643" }, { "category": "external", "summary": "2119645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "category": "external", "summary": "2119646", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119646" }, { "category": "external", "summary": "2119647", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119647" }, { "category": "external", "summary": "2119656", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119656" }, { "category": "external", "summary": "2119657", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119657" }, { "category": "external", "summary": "2119658", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119658" }, { "category": "external", "summary": "2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "2136370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136370" }, { "category": "external", "summary": "2136374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136374" }, { "category": "external", "summary": "2136379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136379" }, { "category": "external", "summary": "2136381", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136381" }, { "category": "external", "summary": "2136382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136382" }, { "category": "external", "summary": "2136383", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136383" }, { "category": "external", "summary": "2136386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136386" }, { "category": "external", "summary": "2136388", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136388" }, { "category": "external", "summary": "2136391", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136391" }, { "category": "external", "summary": "2143086", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143086" }, { "category": "external", "summary": "2143089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143089" }, { "category": "external", "summary": "2143090", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143090" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0560.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 4.10.51 security update", "tracking": { "current_release_date": "2024-12-16T16:06:28+00:00", "generator": { "date": "2024-12-16T16:06:28+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHSA-2023:0560", "initial_release_date": "2023-02-08T18:41:32+00:00", "revision_history": [ { "date": "2023-02-08T18:41:32+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-02-08T18:41:32+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-16T16:06:28+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.10", "product": { "name": "Red Hat OpenShift Container Platform 4.10", "product_id": "7Server-RH7-RHOSE-4.10", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.10::el7" } } }, { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.10", "product": { "name": "Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.10::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "product": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "product_id": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.5-5.rhaos4.10.gitd9dec98.el7?arch=src" } } }, { "category": "product_version", "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "product": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "product_id": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.5-5.rhaos4.10.gitd9dec98.el8?arch=src" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.10.1675144701-1.el8.src", "product": { "name": "jenkins-2-plugins-0:4.10.1675144701-1.el8.src", "product_id": "jenkins-2-plugins-0:4.10.1675144701-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.10.1675144701-1.el8?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "product": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "product_id": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.5-5.rhaos4.10.gitd9dec98.el7?arch=x86_64" } } }, { "category": "product_version", "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "product": { "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "product_id": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debuginfo@1.23.5-5.rhaos4.10.gitd9dec98.el7?arch=x86_64" } } }, { "category": "product_version", "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "product": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "product_id": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.5-5.rhaos4.10.gitd9dec98.el8?arch=x86_64" } } }, { "category": "product_version", "name": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "product": { "name": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "product_id": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debugsource@1.23.5-5.rhaos4.10.gitd9dec98.el8?arch=x86_64" } } }, { "category": "product_version", "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "product": { "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "product_id": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debuginfo@1.23.5-5.rhaos4.10.gitd9dec98.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "product": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "product_id": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.5-5.rhaos4.10.gitd9dec98.el8?arch=aarch64" } } }, { "category": "product_version", "name": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "product": { "name": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "product_id": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debugsource@1.23.5-5.rhaos4.10.gitd9dec98.el8?arch=aarch64" } } }, { "category": "product_version", "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "product": { "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "product_id": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debuginfo@1.23.5-5.rhaos4.10.gitd9dec98.el8?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "product": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "product_id": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.5-5.rhaos4.10.gitd9dec98.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "product": { "name": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "product_id": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debugsource@1.23.5-5.rhaos4.10.gitd9dec98.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "product": { "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "product_id": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debuginfo@1.23.5-5.rhaos4.10.gitd9dec98.el8?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "product": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "product_id": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.5-5.rhaos4.10.gitd9dec98.el8?arch=s390x" } } }, { "category": "product_version", "name": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "product": { "name": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "product_id": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debugsource@1.23.5-5.rhaos4.10.gitd9dec98.el8?arch=s390x" } } }, { "category": "product_version", "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "product": { "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "product_id": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debuginfo@1.23.5-5.rhaos4.10.gitd9dec98.el8?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "product": { "name": "jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "product_id": "jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.10.1675144701-1.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src" }, "product_reference": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64" }, "product_reference": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64" }, "product_reference": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64" }, "product_reference": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le" }, "product_reference": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x" }, "product_reference": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src" }, "product_reference": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" }, "product_reference": "cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64" }, "product_reference": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le" }, "product_reference": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x" }, "product_reference": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" }, "product_reference": "cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64" }, "product_reference": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le" }, "product_reference": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x" }, "product_reference": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" }, "product_reference": "cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch" }, "product_reference": "jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.10.1675144701-1.el8.src as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" }, "product_reference": "jenkins-2-plugins-0:4.10.1675144701-1.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.10" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-7692", "cwe": { "id": "CWE-358", "name": "Improperly Implemented Security Check for Standard" }, "discovery_date": "2020-07-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1856376" } ], "notes": [ { "category": "description", "text": "PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.", "title": "Vulnerability description" }, { "category": "summary", "text": "google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7692" }, { "category": "external", "summary": "RHBZ#1856376", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856376" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7692", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7692" } ], "release_date": "2020-07-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization" }, { "cve": "CVE-2022-25857", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-09-14T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2126789" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Denial of Service due to missing nested depth limitation for collections", "title": "Vulnerability summary" }, { "category": "other", "text": "For RHEL-8 it\u0027s downgraded to moderate because \"snakeyaml\" itself in RHEL 8 or RHEL-9 isn\u0027t shipped and \"prometheus-jmx-exporter\" is needed as build dependency. And it\u0027s not directly exploitable, hence severity marked as moderate.\nRed Hat Integration and AMQ products are not vulnerable to this flaw, so their severity has been lowered to moderate.\nRed Hat Single Sign-On uses snakeyaml from liquibase-core and is only used when performing migrations and would require administrator privileges to execute, hence severity marked as Low.\nRed Hat Fuse 7 is now in Maintenance Support Phase and details about its fix should be present soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25857" }, { "category": "external", "summary": "RHBZ#2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25857", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25857" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" }, { "category": "external", "summary": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525", "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525" } ], "release_date": "2022-08-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "snakeyaml: Denial of Service due to missing nested depth limitation for collections" }, { "cve": "CVE-2022-30946", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119643" } ], "notes": [ { "category": "description", "text": "A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: CSRF vulnerability in Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30946" }, { "category": "external", "summary": "RHBZ#2119643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119643" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30946", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30946" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30946", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30946" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: CSRF vulnerability in Script Security Plugin" }, { "cve": "CVE-2022-30952", "cwe": { "id": "CWE-668", "name": "Exposure of Resource to Wrong Sphere" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119645" } ], "notes": [ { "category": "description", "text": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30952" }, { "category": "external", "summary": "RHBZ#2119645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30952", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30952" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin" }, { "cve": "CVE-2022-30953", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119646" } ], "notes": [ { "category": "description", "text": "A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: CSRF vulnerability in Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30953" }, { "category": "external", "summary": "RHBZ#2119646", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119646" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30953", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30953" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30953", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30953" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: CSRF vulnerability in Blue Ocean Plugin" }, { "cve": "CVE-2022-30954", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119647" } ], "notes": [ { "category": "description", "text": "Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: missing permission checks in Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30954" }, { "category": "external", "summary": "RHBZ#2119647", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119647" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30954", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30954" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30954", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30954" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: missing permission checks in Blue Ocean Plugin" }, { "cve": "CVE-2022-36882", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "discovery_date": "2022-08-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2116840" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Git Jenkins plugin. The affected versions of the Git Jenkins Plugin allow attackers to trigger the builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36882" }, { "category": "external", "summary": "RHBZ#2116840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116840" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36882", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36882" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36882", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36882" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" } ], "release_date": "2022-08-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git" }, { "cve": "CVE-2022-36883", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119656" } ], "notes": [ { "category": "description", "text": "A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Lack of authentication mechanism in Git Plugin webhook", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36883" }, { "category": "external", "summary": "RHBZ#2119656", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119656" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36883", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36883" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36883", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36883" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" } ], "release_date": "2022-07-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: Lack of authentication mechanism in Git Plugin webhook" }, { "cve": "CVE-2022-36884", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119657" } ], "notes": [ { "category": "description", "text": "The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Lack of authentication mechanism in Git Plugin webhook", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36884" }, { "category": "external", "summary": "RHBZ#2119657", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119657" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36884", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36884" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36884", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36884" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" } ], "release_date": "2022-07-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: Lack of authentication mechanism in Git Plugin webhook" }, { "cve": "CVE-2022-36885", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119658" } ], "notes": [ { "category": "description", "text": "Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Non-constant time webhook signature comparison in GitHub Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36885" }, { "category": "external", "summary": "RHBZ#2119658", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119658" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36885", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36885" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849" } ], "release_date": "2022-07-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: Non-constant time webhook signature comparison in GitHub Plugin" }, { "cve": "CVE-2022-43401", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136381" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43401" }, { "category": "external", "summary": "RHBZ#2136381", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136381" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43401", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43401" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43401", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43401" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin" }, { "cve": "CVE-2022-43402", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136379" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43402" }, { "category": "external", "summary": "RHBZ#2136379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136379" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43402", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43402" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43402", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43402" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin" }, { "cve": "CVE-2022-43403", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136382" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43403" }, { "category": "external", "summary": "RHBZ#2136382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43403", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43403" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43403", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43403" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin" }, { "cve": "CVE-2022-43404", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136383" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43404" }, { "category": "external", "summary": "RHBZ#2136383", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136383" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43404", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43404" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43404", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43404" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin" }, { "cve": "CVE-2022-43405", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136374" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43405" }, { "category": "external", "summary": "RHBZ#2136374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43405", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43405" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43405", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43405" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin" }, { "cve": "CVE-2022-43406", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136370" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43406" }, { "category": "external", "summary": "RHBZ#2136370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136370" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43406", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43406" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43406", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43406" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin" }, { "cve": "CVE-2022-43407", "cwe": { "id": "CWE-838", "name": "Inappropriate Encoding for Output Context" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136386" } ], "notes": [ { "category": "description", "text": "A cross-site request forgery (CSRF) vulnerability was found in a Jenkins plugin. This issue may allow an unauthenticated attacker to access Jenkins builds, bypassing CSRF protections. This could compromise the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43407" }, { "category": "external", "summary": "RHBZ#2136386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43407", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43407" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43407", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43407" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin" }, { "cve": "CVE-2022-43408", "cwe": { "id": "CWE-838", "name": "Inappropriate Encoding for Output Context" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136388" } ], "notes": [ { "category": "description", "text": "A Cross-site request forgery (CSRF) vulnerability was found in a Jenkins plugin. This issue may allow an authenticated attacker to access Jenkins builds, bypassing CSRF protections.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43408" }, { "category": "external", "summary": "RHBZ#2136388", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136388" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43408", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43408" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43408", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43408" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin" }, { "cve": "CVE-2022-43409", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136391" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability was found in a Jenkins plugin. This issue may allow an authenticated remote attacker to create Pipelines.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43409" }, { "category": "external", "summary": "RHBZ#2136391", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136391" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43409", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43409" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43409", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43409" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45379", "cwe": { "id": "CWE-328", "name": "Use of Weak Hash" }, "discovery_date": "2022-11-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2143090" } ], "notes": [ { "category": "description", "text": "A flaw was found in the script-security Jenkins Plugin. SHA-1 no longer meets the security standards for producing a cryptographically secure message digest. The affected version of the script-security Plugin stores whole-script approvals as the SHA-1 hash of the approved script.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Whole-script approval in Script Security Plugin vulnerable to SHA-1 collisions", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift 3.11 is already in the ELS support model phase. The Jenkins components are out of scope of the ELS support; hence OpenShift 3.11 Jenkins component is marked in this CVE as out of support scope.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45379" }, { "category": "external", "summary": "RHBZ#2143090", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143090" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45379", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45379" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45379", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45379" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2564", "url": "https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2564" } ], "release_date": "2022-11-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin/script-security: Whole-script approval in Script Security Plugin vulnerable to SHA-1 collisions" }, { "cve": "CVE-2022-45380", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2022-11-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2143086" } ], "notes": [ { "category": "description", "text": "A flaw was found in the JUnit Jenkins Plugin. The affected version of the JUnit plugin converts HTTP(S) URLs in test report output to clickable links, which leads to a stored Cross-site scripting (XSS) attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/JUnit: Stored XSS vulnerability in JUnit Plugin", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift 3.11 is already in the ELS support model phase. The Jenkins components are out of scope of the ELS support; hence OpenShift 3.11 Jenkins component is marked in this CVE as Out of Support Scope.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45380" }, { "category": "external", "summary": "RHBZ#2143086", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143086" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45380", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45380" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45380", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45380" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2888", "url": "https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2888" } ], "release_date": "2022-11-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin/JUnit: Stored XSS vulnerability in JUnit Plugin" }, { "cve": "CVE-2022-45381", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-11-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2143089" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Pipeline Utility Steps Jenkins Plugin. The affected version of the Pipeline Utility Steps Plugin does not restrict the set of enabled prefix interpolators and bundles versions of this library that enable the file: prefix interpolator by default. This flaw allows attackers who can configure Pipelines to read arbitrary files from the Jenkins controller file system.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-utility-steps: Arbitrary file read vulnerability in Pipeline Utility Steps Plugin", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift 3.11 is already in the ELS support model phase. The Jenkins components are out of scope of the ELS support; hence the OpenShift 3.11 Jenkins component is marked in this CVE as out of support scope.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45381" }, { "category": "external", "summary": "RHBZ#2143089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143089" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45381", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45381" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45381", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45381" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2949", "url": "https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2949" } ], "release_date": "2022-11-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-02-08T18:41:32+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0560" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.5-5.rhaos4.10.gitd9dec98.el8.x86_64", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1675144701-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin/pipeline-utility-steps: Arbitrary file read vulnerability in Pipeline Utility Steps Plugin" } ] }
gsd-2022-30952
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2022-30952", "description": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.", "id": "GSD-2022-30952", "references": [ "https://access.redhat.com/errata/RHSA-2023:0017", "https://access.redhat.com/errata/RHSA-2023:0560", "https://access.redhat.com/errata/RHSA-2023:0777", "https://access.redhat.com/errata/RHSA-2023:1064" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2022-30952" ], "details": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.", "id": "GSD-2022-30952", "modified": "2023-12-13T01:19:37.304032Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2022-30952", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Jenkins Pipeline SCM API for Blue Ocean Plugin", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "lessThanOrEqual": "1.25.3", "status": "affected", "version": "unspecified", "versionType": "custom" }, { "status": "unaffected", "version": "1.25.0.1" } ] } } ] } } ] }, "vendor_name": "Jenkins project" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714", "refsource": "MISC", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" }, { "name": "http://www.openwall.com/lists/oss-security/2022/05/17/8", "refsource": "MISC", "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "(,1.25.4)", "affected_versions": "All versions before 1.25.4", "cvss_v2": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-522", "CWE-937" ], "date": "2022-06-02", "description": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.", "fixed_versions": [ "1.25.4" ], "identifier": "CVE-2022-30952", "identifiers": [ "GHSA-g74w-93cp-5p3p", "CVE-2022-30952" ], "not_impacted": "All versions starting from 1.25.4", "package_slug": "maven/io.jenkins.blueocean/blueocean-pipeline-scm-api", "pubdate": "2022-05-18", "solution": "Upgrade to version 1.25.4 or above.", "title": "Insufficiently Protected Credentials", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2022-30952", "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714", "http://www.openwall.com/lists/oss-security/2022/05/17/8", "https://github.com/advisories/GHSA-g74w-93cp-5p3p" ], "uuid": "23f46184-49b2-44db-baac-911918ded199" }, { "affected_range": "(,1.25.3]", "affected_versions": "All versions up to 1.25.3", "cvss_v2": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-522", "CWE-937" ], "date": "2022-11-11", "description": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.", "fixed_versions": [], "identifier": "CVE-2022-30952", "identifiers": [ "CVE-2022-30952" ], "not_impacted": "", "package_slug": "maven/io.jenkins.blueocean/blueocean", "pubdate": "2022-05-17", "solution": "Unfortunately, there is no solution available yet.", "title": "Insufficiently Protected Credentials", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2022-30952", "http://www.openwall.com/lists/oss-security/2022/05/17/8", "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" ], "uuid": "d5555fde-9070-45a9-8195-b326b6aa0f02" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:jenkins:blue_ocean:*:*:*:*:*:jenkins:*:*", "cpe_name": [], "versionEndIncluding": "1.25.3", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2022-30952" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-522" } ] } ] }, "references": { "reference_data": [ { "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8" }, { "name": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714", "refsource": "CONFIRM", "tags": [ "Vendor Advisory" ], "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0" }, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 3.6 } }, "lastModifiedDate": "2023-11-03T18:17Z", "publishedDate": "2022-05-17T15:15Z" } } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.