Action not permitted
Modal body text goes here.
cve-2022-34176
Vulnerability from cvelistv5
Published
2022-06-22 00:00
Modified
2024-08-03 08:16
Severity ?
EPSS score ?
Summary
Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Jenkins project | Jenkins JUnit Plugin |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T08:16:17.216Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Jenkins JUnit Plugin", "vendor": "Jenkins project", "versions": [ { "status": "unaffected", "version": "1.53.0.1" }, { "lessThanOrEqual": "1119.va_a_5e9068da_d7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission." } ], "providerMetadata": { "dateUpdated": "2023-10-24T14:22:19.354Z", "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins" }, "references": [ { "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760" } ] } }, "cveMetadata": { "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2022-34176", "datePublished": "2022-06-22T00:00:00", "dateReserved": "2022-06-21T00:00:00", "dateUpdated": "2024-08-03T08:16:17.216Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-34176\",\"sourceIdentifier\":\"jenkinsci-cert@googlegroups.com\",\"published\":\"2022-06-23T17:15:15.620\",\"lastModified\":\"2023-11-03T02:47:27.337\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.\"},{\"lang\":\"es\",\"value\":\"Jenkins JUnit Plugin versiones 1119.va_a_5e9068da_d7 y anteriores, no escapa a las descripciones de los resultados de las pruebas, resultando en una vulnerabilidad de tipo cross-site scripting (XSS) almacenado, explotable por atacantes con permiso Run/Update\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":3.5},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jenkins:junit:*:*:*:*:*:jenkins:*:*\",\"versionEndIncluding\":\"1119.va_a_5e9068da_d7\",\"matchCriteriaId\":\"8762038D-78D5-4BB0-8671-8BD1DE318CC7\"}]}]}],\"references\":[{\"url\":\"https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760\",\"source\":\"jenkinsci-cert@googlegroups.com\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
rhba-2022_8582
Vulnerability from csaf_redhat
Published
2022-11-23 17:59
Modified
2024-11-05 16:02
Summary
Red Hat Bug Fix Advisory: OpenShift Container Platform 4.9.52 packages update
Notes
Topic
Red Hat OpenShift Container Platform release 4.9.52 is now available with
updates to packages and images that fix several bugs.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 4.9.52. See the following advisory for the container images for
this release:
https://access.redhat.com/errata/RHBA-2022:8485
All OpenShift Container Platform 4.9 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift Console
or the CLI oc command. Instructions for upgrading a cluster are available
at
https://docs.openshift.com/container-platform/4.9/updating/updating-cluster-cli.html
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat OpenShift Container Platform release 4.9.52 is now available with\nupdates to packages and images that fix several bugs.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the RPM packages for Red Hat OpenShift Container\nPlatform 4.9.52. See the following advisory for the container images for\nthis release:\n\nhttps://access.redhat.com/errata/RHBA-2022:8485\n\nAll OpenShift Container Platform 4.9 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift Console\nor the CLI oc command. Instructions for upgrading a cluster are available\nat\nhttps://docs.openshift.com/container-platform/4.9/updating/updating-cluster-cli.html", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHBA-2022:8582", "url": "https://access.redhat.com/errata/RHBA-2022:8582" }, { "category": "external", "summary": "OCPBUGS-3983", "url": "https://issues.redhat.com/browse/OCPBUGS-3983" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_8582.json" } ], "title": "Red Hat Bug Fix Advisory: OpenShift Container Platform 4.9.52 packages update", "tracking": { "current_release_date": "2024-11-05T16:02:37+00:00", "generator": { "date": "2024-11-05T16:02:37+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHBA-2022:8582", "initial_release_date": "2022-11-23T17:59:01+00:00", "revision_history": [ { "date": "2022-11-23T17:59:01+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-11-23T17:59:01+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T16:02:37+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.9", "product": { "name": "Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.9::el8" } } }, { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.9", "product": { "name": "Red Hat OpenShift Container Platform 4.9", "product_id": "7Server-RH7-RHOSE-4.9", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.9::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "jenkins-0:2.346.1.1667459710-1.el8.src", "product": { "name": "jenkins-0:2.346.1.1667459710-1.el8.src", "product_id": "jenkins-0:2.346.1.1667459710-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.346.1.1667459710-1.el8?arch=src" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.9.1667460322-1.el8.src", "product": { "name": "jenkins-2-plugins-0:4.9.1667460322-1.el8.src", "product_id": "jenkins-2-plugins-0:4.9.1667460322-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.9.1667460322-1.el8?arch=src" } } }, { "category": "product_version", "name": "openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.src", "product": { "name": "openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.src", "product_id": "openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift@4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8?arch=src" } } }, { "category": "product_version", "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.src", "product": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.src", "product_id": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-clients@4.9.0-202210242129.p0.gb49c285.assembly.stream.el8?arch=src" } } }, { "category": "product_version", "name": "python-kubernetes-0:22.6.0-1.el8.src", "product": { "name": "python-kubernetes-0:22.6.0-1.el8.src", "product_id": "python-kubernetes-0:22.6.0-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-kubernetes@22.6.0-1.el8?arch=src" } } }, { "category": "product_version", "name": "openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.src", "product": { "name": "openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.src", "product_id": "openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift@4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7?arch=src" } } }, { "category": "product_version", "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.src", "product": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.src", "product_id": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-clients@4.9.0-202210242129.p0.gb49c285.assembly.stream.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jenkins-0:2.346.1.1667459710-1.el8.noarch", "product": { "name": "jenkins-0:2.346.1.1667459710-1.el8.noarch", "product_id": "jenkins-0:2.346.1.1667459710-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.346.1.1667459710-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.9.1667460322-1.el8.noarch", "product": { "name": "jenkins-2-plugins-0:4.9.1667460322-1.el8.noarch", "product_id": "jenkins-2-plugins-0:4.9.1667460322-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.9.1667460322-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "python3-kubernetes-0:22.6.0-1.el8.noarch", "product": { "name": "python3-kubernetes-0:22.6.0-1.el8.noarch", "product_id": "python3-kubernetes-0:22.6.0-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-kubernetes@22.6.0-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "python3-kubernetes-tests-0:22.6.0-1.el8.noarch", "product": { "name": "python3-kubernetes-tests-0:22.6.0-1.el8.noarch", "product_id": "python3-kubernetes-tests-0:22.6.0-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-kubernetes-tests@22.6.0-1.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.x86_64", "product": { "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.x86_64", "product_id": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8?arch=x86_64" } } }, { "category": "product_version", "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "product": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "product_id": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-clients@4.9.0-202210242129.p0.gb49c285.assembly.stream.el8?arch=x86_64" } } }, { "category": "product_version", "name": "openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "product": { "name": "openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "product_id": "openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-clients-redistributable@4.9.0-202210242129.p0.gb49c285.assembly.stream.el8?arch=x86_64" } } }, { "category": "product_version", "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.x86_64", "product": { "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.x86_64", "product_id": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7?arch=x86_64" } } }, { "category": "product_version", "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "product": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "product_id": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-clients@4.9.0-202210242129.p0.gb49c285.assembly.stream.el7?arch=x86_64" } } }, { "category": "product_version", "name": "openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "product": { "name": "openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "product_id": "openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-clients-redistributable@4.9.0-202210242129.p0.gb49c285.assembly.stream.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.aarch64", "product": { "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.aarch64", "product_id": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8?arch=aarch64" } } }, { "category": "product_version", "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.aarch64", "product": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.aarch64", "product_id": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-clients@4.9.0-202210242129.p0.gb49c285.assembly.stream.el8?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.ppc64le", "product": { "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.ppc64le", "product_id": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.ppc64le", "product": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.ppc64le", "product_id": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-clients@4.9.0-202210242129.p0.gb49c285.assembly.stream.el8?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.s390x", "product": { "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.s390x", "product_id": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-hyperkube@4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8?arch=s390x" } } }, { "category": "product_version", "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.s390x", "product": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.s390x", "product_id": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openshift-clients@4.9.0-202210242129.p0.gb49c285.assembly.stream.el8?arch=s390x" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.src as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "7Server-RH7-RHOSE-4.9:openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.src" }, "product_reference": "openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.src as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "7Server-RH7-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.src" }, "product_reference": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "7Server-RH7-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64" }, "product_reference": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "7Server-RH7-RHOSE-4.9:openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64" }, "product_reference": "openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "7Server-RH7-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.x86_64" }, "product_reference": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.346.1.1667459710-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:jenkins-0:2.346.1.1667459710-1.el8.noarch" }, "product_reference": "jenkins-0:2.346.1.1667459710-1.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.346.1.1667459710-1.el8.src as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:jenkins-0:2.346.1.1667459710-1.el8.src" }, "product_reference": "jenkins-0:2.346.1.1667459710-1.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.9.1667460322-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.noarch" }, "product_reference": "jenkins-2-plugins-0:4.9.1667460322-1.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.9.1667460322-1.el8.src as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.src" }, "product_reference": "jenkins-2-plugins-0:4.9.1667460322-1.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.src as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.src" }, "product_reference": "openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.aarch64" }, "product_reference": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.aarch64", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.ppc64le" }, "product_reference": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.ppc64le", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.s390x as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.s390x" }, "product_reference": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.s390x", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.src as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.src" }, "product_reference": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64" }, "product_reference": "openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64" }, "product_reference": "openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.aarch64" }, "product_reference": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.aarch64", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.ppc64le" }, "product_reference": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.ppc64le", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.s390x as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.s390x" }, "product_reference": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.s390x", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.x86_64" }, "product_reference": "openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "python-kubernetes-0:22.6.0-1.el8.src as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:python-kubernetes-0:22.6.0-1.el8.src" }, "product_reference": "python-kubernetes-0:22.6.0-1.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "python3-kubernetes-0:22.6.0-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:python3-kubernetes-0:22.6.0-1.el8.noarch" }, "product_reference": "python3-kubernetes-0:22.6.0-1.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.9" }, { "category": "default_component_of", "full_product_name": { "name": "python3-kubernetes-tests-0:22.6.0-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.9", "product_id": "8Base-RHOSE-4.9:python3-kubernetes-tests-0:22.6.0-1.el8.noarch" }, "product_reference": "python3-kubernetes-tests-0:22.6.0-1.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.9" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-34176", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2022-07-04T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.9:openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.src", "7Server-RH7-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.src", "7Server-RH7-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "7Server-RH7-RHOSE-4.9:openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "7Server-RH7-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.x86_64", "8Base-RHOSE-4.9:jenkins-0:2.346.1.1667459710-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.346.1.1667459710-1.el8.src", "8Base-RHOSE-4.9:openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.src", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.aarch64", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.ppc64le", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.s390x", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.src", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "8Base-RHOSE-4.9:openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.aarch64", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.ppc64le", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.s390x", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.x86_64", "8Base-RHOSE-4.9:python-kubernetes-0:22.6.0-1.el8.src", "8Base-RHOSE-4.9:python3-kubernetes-0:22.6.0-1.el8.noarch", "8Base-RHOSE-4.9:python3-kubernetes-tests-0:22.6.0-1.el8.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2103548" } ], "notes": [ { "category": "description", "text": "A flaw was found in the JUnit Jenkins plugin. The manipulation with an unknown input leads to a Cross-site scripting vulnerability, impacting the integrity. This flaw allows an attacker to inject arbitrary HTML and script code into the website.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.9:openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.src", "7Server-RH7-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.src", "7Server-RH7-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "7Server-RH7-RHOSE-4.9:openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "7Server-RH7-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.x86_64", "8Base-RHOSE-4.9:jenkins-0:2.346.1.1667459710-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.346.1.1667459710-1.el8.src", "8Base-RHOSE-4.9:openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.src", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.aarch64", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.ppc64le", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.s390x", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.src", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "8Base-RHOSE-4.9:openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.aarch64", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.ppc64le", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.s390x", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.x86_64", "8Base-RHOSE-4.9:python-kubernetes-0:22.6.0-1.el8.src", "8Base-RHOSE-4.9:python3-kubernetes-0:22.6.0-1.el8.noarch", "8Base-RHOSE-4.9:python3-kubernetes-tests-0:22.6.0-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-34176" }, { "category": "external", "summary": "RHBZ#2103548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103548" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-34176", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34176" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34176", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34176" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760", "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760" } ], "release_date": "2022-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-11-23T17:59:01+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.9/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2022:8582" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin" }, { "cve": "CVE-2022-36881", "cwe": { "id": "CWE-322", "name": "Key Exchange without Entity Authentication" }, "discovery_date": "2022-08-03T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.9:openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.src", "7Server-RH7-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.src", "7Server-RH7-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "7Server-RH7-RHOSE-4.9:openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "7Server-RH7-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.x86_64", "8Base-RHOSE-4.9:jenkins-0:2.346.1.1667459710-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.346.1.1667459710-1.el8.src", "8Base-RHOSE-4.9:openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.src", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.aarch64", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.ppc64le", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.s390x", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.src", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "8Base-RHOSE-4.9:openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.aarch64", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.ppc64le", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.s390x", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.x86_64", "8Base-RHOSE-4.9:python-kubernetes-0:22.6.0-1.el8.src", "8Base-RHOSE-4.9:python3-kubernetes-0:22.6.0-1.el8.noarch", "8Base-RHOSE-4.9:python3-kubernetes-tests-0:22.6.0-1.el8.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2114755" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.9:openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.src", "7Server-RH7-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.src", "7Server-RH7-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "7Server-RH7-RHOSE-4.9:openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el7.x86_64", "7Server-RH7-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el7.x86_64", "8Base-RHOSE-4.9:jenkins-0:2.346.1.1667459710-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-0:2.346.1.1667459710-1.el8.src", "8Base-RHOSE-4.9:openshift-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.src", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.aarch64", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.ppc64le", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.s390x", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.src", "8Base-RHOSE-4.9:openshift-clients-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "8Base-RHOSE-4.9:openshift-clients-redistributable-0:4.9.0-202210242129.p0.gb49c285.assembly.stream.el8.x86_64", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.aarch64", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.ppc64le", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.s390x", "8Base-RHOSE-4.9:openshift-hyperkube-0:4.9.0-202210242129.p0.g9e95cb9.assembly.stream.el8.x86_64", "8Base-RHOSE-4.9:python-kubernetes-0:22.6.0-1.el8.src", "8Base-RHOSE-4.9:python3-kubernetes-0:22.6.0-1.el8.noarch", "8Base-RHOSE-4.9:python3-kubernetes-tests-0:22.6.0-1.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36881" }, { "category": "external", "summary": "RHBZ#2114755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2114755" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36881" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-cm7j-p8hc-97vj", "url": "https://github.com/advisories/GHSA-cm7j-p8hc-97vj" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468" } ], "release_date": "2022-08-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-11-23T17:59:01+00:00", "details": "For OpenShift Container Platform 4.9 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.9/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2022:8582" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.noarch", "8Base-RHOSE-4.9:jenkins-2-plugins-0:4.9.1667460322-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client" } ] }
rhsa-2022_6531
Vulnerability from csaf_redhat
Published
2022-09-21 14:03
Modified
2024-11-06 01:39
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.10.33 packages and security update
Notes
Topic
Red Hat OpenShift Container Platform release 4.10.33 is now available with
updates to packages and images that fix several bugs and add enhancements.
This release includes a security update for Red Hat OpenShift Container Platform 4.10.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.10.33. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHBA-2022:6532
Security Fix(es):
* jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step
Plugin (CVE-2022-34177)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.
All OpenShift Container Platform 4.10 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat OpenShift Container Platform release 4.10.33 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.10.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.10.33. See the following advisory for the container images for this release:\n\nhttps://access.redhat.com/errata/RHBA-2022:6532\n\nSecurity Fix(es):\n\n* jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step\nPlugin (CVE-2022-34177)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s)\nlisted in the References section.\n\nAll OpenShift Container Platform 4.10 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:6531", "url": "https://access.redhat.com/errata/RHSA-2022:6531" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2103551", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103551" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6531.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 4.10.33 packages and security update", "tracking": { "current_release_date": "2024-11-06T01:39:07+00:00", "generator": { "date": "2024-11-06T01:39:07+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2022:6531", "initial_release_date": "2022-09-21T14:03:24+00:00", "revision_history": [ { "date": "2022-09-21T14:03:24+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-09-21T14:03:24+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T01:39:07+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.10", "product": { "name": "Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.10::el8" } } }, { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.10", "product": { "name": "Red Hat OpenShift Container Platform 4.10", "product_id": "7Server-RH7-RHOSE-4.10", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.10::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.src", "product": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.src", "product_id": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.3-17.rhaos4.10.git016b1ca.el8?arch=src" } } }, { "category": "product_version", "name": "jenkins-0:2.346.3.1663151230-1.el8.src", "product": { "name": "jenkins-0:2.346.3.1663151230-1.el8.src", "product_id": "jenkins-0:2.346.3.1663151230-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.346.3.1663151230-1.el8?arch=src" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.10.1663147786-1.el8.src", "product": { "name": "jenkins-2-plugins-0:4.10.1663147786-1.el8.src", "product_id": "jenkins-2-plugins-0:4.10.1663147786-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.10.1663147786-1.el8?arch=src" } } }, { "category": "product_version", "name": "openstack-ironic-1:19.0.1-0.20220907234401.d85d7f8.el8.src", "product": { "name": "openstack-ironic-1:19.0.1-0.20220907234401.d85d7f8.el8.src", "product_id": "openstack-ironic-1:19.0.1-0.20220907234401.d85d7f8.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-ironic@19.0.1-0.20220907234401.d85d7f8.el8?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "python-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.src", "product": { "name": "python-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.src", "product_id": "python-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-sushy@4.1.2-0.20220913104404.1ae8e49.el8?arch=src" } } }, { "category": "product_version", "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.src", "product": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.src", "product_id": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.3-17.rhaos4.10.git016b1ca.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "product": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "product_id": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.3-17.rhaos4.10.git016b1ca.el8?arch=x86_64" } } }, { "category": "product_version", "name": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "product": { "name": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "product_id": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debugsource@1.23.3-17.rhaos4.10.git016b1ca.el8?arch=x86_64" } } }, { "category": "product_version", "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "product": { "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "product_id": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debuginfo@1.23.3-17.rhaos4.10.git016b1ca.el8?arch=x86_64" } } }, { "category": "product_version", "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "product": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "product_id": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.3-17.rhaos4.10.git016b1ca.el7?arch=x86_64" } } }, { "category": "product_version", "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "product": { "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "product_id": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debuginfo@1.23.3-17.rhaos4.10.git016b1ca.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "product": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "product_id": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.3-17.rhaos4.10.git016b1ca.el8?arch=aarch64" } } }, { "category": "product_version", "name": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "product": { "name": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "product_id": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debugsource@1.23.3-17.rhaos4.10.git016b1ca.el8?arch=aarch64" } } }, { "category": "product_version", "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "product": { "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "product_id": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debuginfo@1.23.3-17.rhaos4.10.git016b1ca.el8?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "product": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "product_id": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.3-17.rhaos4.10.git016b1ca.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "product": { "name": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "product_id": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debugsource@1.23.3-17.rhaos4.10.git016b1ca.el8?arch=ppc64le" } } }, { "category": "product_version", "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "product": { "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "product_id": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debuginfo@1.23.3-17.rhaos4.10.git016b1ca.el8?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "product": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "product_id": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o@1.23.3-17.rhaos4.10.git016b1ca.el8?arch=s390x" } } }, { "category": "product_version", "name": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "product": { "name": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "product_id": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debugsource@1.23.3-17.rhaos4.10.git016b1ca.el8?arch=s390x" } } }, { "category": "product_version", "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "product": { "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "product_id": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/cri-o-debuginfo@1.23.3-17.rhaos4.10.git016b1ca.el8?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "jenkins-0:2.346.3.1663151230-1.el8.noarch", "product": { "name": "jenkins-0:2.346.3.1663151230-1.el8.noarch", "product_id": "jenkins-0:2.346.3.1663151230-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.346.3.1663151230-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.10.1663147786-1.el8.noarch", "product": { "name": "jenkins-2-plugins-0:4.10.1663147786-1.el8.noarch", "product_id": "jenkins-2-plugins-0:4.10.1663147786-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.10.1663147786-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "openstack-ironic-api-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "product": { "name": "openstack-ironic-api-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "product_id": "openstack-ironic-api-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-ironic-api@19.0.1-0.20220907234401.d85d7f8.el8?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "openstack-ironic-common-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "product": { "name": "openstack-ironic-common-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "product_id": "openstack-ironic-common-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-ironic-common@19.0.1-0.20220907234401.d85d7f8.el8?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "openstack-ironic-conductor-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "product": { "name": "openstack-ironic-conductor-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "product_id": "openstack-ironic-conductor-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-ironic-conductor@19.0.1-0.20220907234401.d85d7f8.el8?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "python3-ironic-tests-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "product": { "name": "python3-ironic-tests-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "product_id": "python3-ironic-tests-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-ironic-tests@19.0.1-0.20220907234401.d85d7f8.el8?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "python3-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch", "product": { "name": "python3-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch", "product_id": "python3-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-sushy@4.1.2-0.20220913104404.1ae8e49.el8?arch=noarch" } } }, { "category": "product_version", "name": "python3-sushy-tests-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch", "product": { "name": "python3-sushy-tests-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch", "product_id": "python3-sushy-tests-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-sushy-tests@4.1.2-0.20220913104404.1ae8e49.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.src as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.src" }, "product_reference": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64" }, "product_reference": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64" }, "product_reference": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64" }, "product_reference": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le" }, "product_reference": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x" }, "product_reference": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.src as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.src" }, "product_reference": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64" }, "product_reference": "cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64" }, "product_reference": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le" }, "product_reference": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x" }, "product_reference": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64" }, "product_reference": "cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64" }, "product_reference": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le" }, "product_reference": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x" }, "product_reference": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64" }, "product_reference": "cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.346.3.1663151230-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:jenkins-0:2.346.3.1663151230-1.el8.noarch" }, "product_reference": "jenkins-0:2.346.3.1663151230-1.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.346.3.1663151230-1.el8.src as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:jenkins-0:2.346.3.1663151230-1.el8.src" }, "product_reference": "jenkins-0:2.346.3.1663151230-1.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.10.1663147786-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.noarch" }, "product_reference": "jenkins-2-plugins-0:4.10.1663147786-1.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.10.1663147786-1.el8.src as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.src" }, "product_reference": "jenkins-2-plugins-0:4.10.1663147786-1.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-ironic-1:19.0.1-0.20220907234401.d85d7f8.el8.src as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:openstack-ironic-1:19.0.1-0.20220907234401.d85d7f8.el8.src" }, "product_reference": "openstack-ironic-1:19.0.1-0.20220907234401.d85d7f8.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-ironic-api-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:openstack-ironic-api-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch" }, "product_reference": "openstack-ironic-api-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-ironic-common-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:openstack-ironic-common-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch" }, "product_reference": "openstack-ironic-common-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-ironic-conductor-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:openstack-ironic-conductor-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch" }, "product_reference": "openstack-ironic-conductor-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "python-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.src as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:python-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.src" }, "product_reference": "python-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "python3-ironic-tests-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:python3-ironic-tests-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch" }, "product_reference": "python3-ironic-tests-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "python3-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:python3-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch" }, "product_reference": "python3-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.10" }, { "category": "default_component_of", "full_product_name": { "name": "python3-sushy-tests-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch as a component of Red Hat OpenShift Container Platform 4.10", "product_id": "8Base-RHOSE-4.10:python3-sushy-tests-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch" }, "product_reference": "python3-sushy-tests-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.10" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-34176", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2022-07-04T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "8Base-RHOSE-4.10:jenkins-0:2.346.3.1663151230-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-0:2.346.3.1663151230-1.el8.src", "8Base-RHOSE-4.10:openstack-ironic-1:19.0.1-0.20220907234401.d85d7f8.el8.src", "8Base-RHOSE-4.10:openstack-ironic-api-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:openstack-ironic-common-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:openstack-ironic-conductor-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:python-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.src", "8Base-RHOSE-4.10:python3-ironic-tests-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:python3-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch", "8Base-RHOSE-4.10:python3-sushy-tests-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2103548" } ], "notes": [ { "category": "description", "text": "A flaw was found in the JUnit Jenkins plugin. The manipulation with an unknown input leads to a Cross-site scripting vulnerability, impacting the integrity. This flaw allows an attacker to inject arbitrary HTML and script code into the website.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "8Base-RHOSE-4.10:jenkins-0:2.346.3.1663151230-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-0:2.346.3.1663151230-1.el8.src", "8Base-RHOSE-4.10:openstack-ironic-1:19.0.1-0.20220907234401.d85d7f8.el8.src", "8Base-RHOSE-4.10:openstack-ironic-api-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:openstack-ironic-common-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:openstack-ironic-conductor-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:python-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.src", "8Base-RHOSE-4.10:python3-ironic-tests-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:python3-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch", "8Base-RHOSE-4.10:python3-sushy-tests-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-34176" }, { "category": "external", "summary": "RHBZ#2103548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103548" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-34176", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34176" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34176", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34176" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760", "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760" } ], "release_date": "2022-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-09-21T14:03:24+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:6531" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin" }, { "cve": "CVE-2022-34177", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-07-04T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "8Base-RHOSE-4.10:jenkins-0:2.346.3.1663151230-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-0:2.346.3.1663151230-1.el8.src", "8Base-RHOSE-4.10:openstack-ironic-1:19.0.1-0.20220907234401.d85d7f8.el8.src", "8Base-RHOSE-4.10:openstack-ironic-api-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:openstack-ironic-common-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:openstack-ironic-conductor-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:python-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.src", "8Base-RHOSE-4.10:python3-ironic-tests-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:python3-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch", "8Base-RHOSE-4.10:python3-sushy-tests-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2103551" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Pipeline Input Step Plugin. This issue affects the code of the component Archive File Handler. The manipulation of the argument file with a malicious input leads to a directory traversal vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.src" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.src", "7Server-RH7-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "7Server-RH7-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el7.x86_64", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.src", "8Base-RHOSE-4.10:cri-o-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "8Base-RHOSE-4.10:cri-o-debuginfo-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.aarch64", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.ppc64le", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.s390x", "8Base-RHOSE-4.10:cri-o-debugsource-0:1.23.3-17.rhaos4.10.git016b1ca.el8.x86_64", "8Base-RHOSE-4.10:jenkins-0:2.346.3.1663151230-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-0:2.346.3.1663151230-1.el8.src", "8Base-RHOSE-4.10:openstack-ironic-1:19.0.1-0.20220907234401.d85d7f8.el8.src", "8Base-RHOSE-4.10:openstack-ironic-api-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:openstack-ironic-common-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:openstack-ironic-conductor-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:python-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.src", "8Base-RHOSE-4.10:python3-ironic-tests-1:19.0.1-0.20220907234401.d85d7f8.el8.noarch", "8Base-RHOSE-4.10:python3-sushy-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch", "8Base-RHOSE-4.10:python3-sushy-tests-0:4.1.2-0.20220913104404.1ae8e49.el8.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-34177" }, { "category": "external", "summary": "RHBZ#2103551", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103551" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-34177", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34177" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34177", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34177" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2705", "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2705" } ], "release_date": "2022-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-09-21T14:03:24+00:00", "details": "For OpenShift Container Platform 4.10 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:6531" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.noarch", "8Base-RHOSE-4.10:jenkins-2-plugins-0:4.10.1663147786-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin" } ] }
rhsa-2023_0017
Vulnerability from csaf_redhat
Published
2023-01-12 16:49
Modified
2024-11-06 02:10
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update
Notes
Topic
Red Hat OpenShift Container Platform release 4.8.56 is now available with
updates to packages and images that fix several bugs and add enhancements.
This release includes a security update for Red Hat OpenShift Container Platform 4.8.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.8.56. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHBA-2023:0018
Security Fix(es):
* Pipeline Shared Groovy Libraries: Untrusted users can modify some
Pipeline libraries in Pipeline Shared Groovy Libraries Plugin
(CVE-2022-29047)
* Jenkins plugin: Sandbox bypass vulnerability through implicitly
allowlisted platform Groovy files in Pipeline: Groovy Plugin
(CVE-2022-30945)
* Jenkins plugin: Mercurial SCM plugin can check out from the controller
file system (CVE-2022-30948)
* jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step
Plugin (CVE-2022-34177)
* jenkins-plugin: Man-in-the-Middle (MitM) in
org.jenkins-ci.plugins:git-client (CVE-2022-36881)
* http2-server: Invalid HTTP/2 requests cause DoS (CVE-2022-2048)
* Jenkins plugin: CSRF vulnerability in Script Security Plugin
(CVE-2022-30946)
* Jenkins plugin: User-scoped credentials exposed to other users by
Pipeline SCM API for Blue Ocean Plugin (CVE-2022-30952)
* Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)
* Jenkins plugin: missing permission checks in Blue Ocean Plugin
(CVE-2022-30954)
* jenkins: Observable timing discrepancy allows determining username
validity (CVE-2022-34174)
* jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin
(CVE-2022-34176)
* jenkins-plugin: Cross-site Request Forgery (CSRF) in
org.jenkins-ci.plugins:git (CVE-2022-36882)
* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook
(CVE-2022-36883)
* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook
(CVE-2022-36884)
* jenkins plugin: Non-constant time webhook signature comparison in GitHub
Plugin (CVE-2022-36885)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat OpenShift Container Platform release 4.8.56 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.8.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.8.56. See the following advisory for the container images for this release:\n\nhttps://access.redhat.com/errata/RHBA-2023:0018\n\nSecurity Fix(es):\n\n* Pipeline Shared Groovy Libraries: Untrusted users can modify some\nPipeline libraries in Pipeline Shared Groovy Libraries Plugin\n(CVE-2022-29047)\n* Jenkins plugin: Sandbox bypass vulnerability through implicitly\nallowlisted platform Groovy files in Pipeline: Groovy Plugin\n(CVE-2022-30945)\n* Jenkins plugin: Mercurial SCM plugin can check out from the controller\nfile system (CVE-2022-30948)\n* jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step\nPlugin (CVE-2022-34177)\n* jenkins-plugin: Man-in-the-Middle (MitM) in\norg.jenkins-ci.plugins:git-client (CVE-2022-36881)\n* http2-server: Invalid HTTP/2 requests cause DoS (CVE-2022-2048)\n* Jenkins plugin: CSRF vulnerability in Script Security Plugin\n(CVE-2022-30946)\n* Jenkins plugin: User-scoped credentials exposed to other users by\nPipeline SCM API for Blue Ocean Plugin (CVE-2022-30952)\n* Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)\n* Jenkins plugin: missing permission checks in Blue Ocean Plugin\n(CVE-2022-30954)\n* jenkins: Observable timing discrepancy allows determining username\nvalidity (CVE-2022-34174)\n* jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin\n(CVE-2022-34176)\n* jenkins-plugin: Cross-site Request Forgery (CSRF) in\norg.jenkins-ci.plugins:git (CVE-2022-36882)\n* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook\n(CVE-2022-36883)\n* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook\n(CVE-2022-36884)\n* jenkins plugin: Non-constant time webhook signature comparison in GitHub\nPlugin (CVE-2022-36885)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s)\nlisted in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0017", "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2074855", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074855" }, { "category": "external", "summary": "2103548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103548" }, { "category": "external", "summary": "2103551", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103551" }, { "category": "external", "summary": "2114755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2114755" }, { "category": "external", "summary": "2116840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116840" }, { "category": "external", "summary": "2116952", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116952" }, { "category": "external", "summary": "2119642", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119642" }, { "category": "external", "summary": "2119643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119643" }, { "category": "external", "summary": "2119644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119644" }, { "category": "external", "summary": "2119645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "category": "external", "summary": "2119646", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119646" }, { "category": "external", "summary": "2119647", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119647" }, { "category": "external", "summary": "2119653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119653" }, { "category": "external", "summary": "2119656", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119656" }, { "category": "external", "summary": "2119657", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119657" }, { "category": "external", "summary": "2119658", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119658" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0017.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update", "tracking": { "current_release_date": "2024-11-06T02:10:59+00:00", "generator": { "date": "2024-11-06T02:10:59+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:0017", "initial_release_date": "2023-01-12T16:49:54+00:00", "revision_history": [ { "date": "2023-01-12T16:49:54+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-01-12T16:49:54+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T02:10:59+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.8", "product": { "name": "Red Hat OpenShift Container Platform 4.8", "product_id": "8Base-RHOSE-4.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.8::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "jenkins-0:2.361.1.1672840472-1.el8.src", "product": { "name": "jenkins-0:2.361.1.1672840472-1.el8.src", "product_id": "jenkins-0:2.361.1.1672840472-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.361.1.1672840472-1.el8?arch=src" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src", "product": { "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src", "product_id": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.8.1672842762-1.el8?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jenkins-0:2.361.1.1672840472-1.el8.noarch", "product": { "name": "jenkins-0:2.361.1.1672840472-1.el8.noarch", "product_id": "jenkins-0:2.361.1.1672840472-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.361.1.1672840472-1.el8?arch=noarch" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "product": { "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "product_id": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.8.1672842762-1.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.361.1.1672840472-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.8", "product_id": "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch" }, "product_reference": "jenkins-0:2.361.1.1672840472-1.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.8" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.361.1.1672840472-1.el8.src as a component of Red Hat OpenShift Container Platform 4.8", "product_id": "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" }, "product_reference": "jenkins-0:2.361.1.1672840472-1.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.8" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.8", "product_id": "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch" }, "product_reference": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "relates_to_product_reference": "8Base-RHOSE-4.8" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src as a component of Red Hat OpenShift Container Platform 4.8", "product_id": "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" }, "product_reference": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src", "relates_to_product_reference": "8Base-RHOSE-4.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-2048", "cwe": { "id": "CWE-410", "name": "Insufficient Resource Pool" }, "discovery_date": "2022-08-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2116952" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Eclipse Jetty http2-server package. This flaw allows an attacker to cause a denial of service in the server via HTTP/2 requests.", "title": "Vulnerability description" }, { "category": "summary", "text": "http2-server: Invalid HTTP/2 requests cause DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2048" }, { "category": "external", "summary": "RHBZ#2116952", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116952" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2048", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2048" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2048", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2048" }, { "category": "external", "summary": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j", "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j" } ], "release_date": "2022-07-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "http2-server: Invalid HTTP/2 requests cause DoS" }, { "cve": "CVE-2022-29047", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2022-04-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2074855" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Jenkins Pipeline: Shared Groovy Libraries plugin. The Jenkins Pipeline: Shared Groovy Libraries plugin allows attackers to submit pull requests. However, the attacker cannot commit directly to the configured Source Control Management (SCM) to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even with the Pipeline configured not to trust them.", "title": "Vulnerability description" }, { "category": "summary", "text": "Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-29047" }, { "category": "external", "summary": "RHBZ#2074855", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074855" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29047" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951", "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951" } ], "release_date": "2022-04-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin" }, { "cve": "CVE-2022-30945", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119642" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jenkins Groovy Plugin. The plugin allows pipelines to load Groovy source files. The intent is to allow Global Shared Libraries to execute without sandbox protection. The issue is that the plugin allows any Groovy source files bundled with Jenkins core and plugins to be loaded this way and their methods executed. If a suitable Groovy source file is available on the classpath of Jenkins, sandbox protections can be bypassed. No Groovy source files were found in Jenkins core or plugins that could result in attackers executing dangerous code; hence successful exploitation is considered highly unlikely.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Pipeline: Groovy Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30945" }, { "category": "external", "summary": "RHBZ#2119642", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119642" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30945", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30945" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30945", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30945" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "plugin: Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Pipeline: Groovy Plugin" }, { "cve": "CVE-2022-30946", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119643" } ], "notes": [ { "category": "description", "text": "A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: CSRF vulnerability in Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30946" }, { "category": "external", "summary": "RHBZ#2119643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119643" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30946", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30946" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30946", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30946" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: CSRF vulnerability in Script Security Plugin" }, { "cve": "CVE-2022-30948", "cwe": { "id": "CWE-435", "name": "Improper Interaction Between Multiple Correctly-Behaving Entities" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119644" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Jenkins plugin. Affected versions of the Jenkins Mercurial Plugin allow attackers who can configure pipelines to check out some SCM repositories stored on the Jenkins controller\u0027s file system. This is accomplished by using local paths as SCM URLs, obtaining limited information about other projects\u0027 SCM contents.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Mercurial SCM plugin can check out from the controller file system", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30948" }, { "category": "external", "summary": "RHBZ#2119644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119644" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30948", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30948" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30948", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30948" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "plugin: Mercurial SCM plugin can check out from the controller file system" }, { "cve": "CVE-2022-30952", "cwe": { "id": "CWE-668", "name": "Exposure of Resource to Wrong Sphere" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119645" } ], "notes": [ { "category": "description", "text": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30952" }, { "category": "external", "summary": "RHBZ#2119645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30952", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30952" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin" }, { "cve": "CVE-2022-30953", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119646" } ], "notes": [ { "category": "description", "text": "A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: CSRF vulnerability in Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30953" }, { "category": "external", "summary": "RHBZ#2119646", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119646" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30953", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30953" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30953", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30953" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: CSRF vulnerability in Blue Ocean Plugin" }, { "cve": "CVE-2022-30954", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119647" } ], "notes": [ { "category": "description", "text": "Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: missing permission checks in Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30954" }, { "category": "external", "summary": "RHBZ#2119647", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119647" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30954", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30954" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30954", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30954" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: missing permission checks in Blue Ocean Plugin" }, { "cve": "CVE-2022-34174", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119653" } ], "notes": [ { "category": "description", "text": "In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins: Observable timing discrepancy allows determining username validity", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-34174" }, { "category": "external", "summary": "RHBZ#2119653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119653" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-34174", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34174" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34174", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34174" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566", "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566" } ], "release_date": "2022-06-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins: Observable timing discrepancy allows determining username validity" }, { "cve": "CVE-2022-34176", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2022-07-04T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2103548" } ], "notes": [ { "category": "description", "text": "A flaw was found in the JUnit Jenkins plugin. The manipulation with an unknown input leads to a Cross-site scripting vulnerability, impacting the integrity. This flaw allows an attacker to inject arbitrary HTML and script code into the website.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-34176" }, { "category": "external", "summary": "RHBZ#2103548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103548" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-34176", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34176" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34176", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34176" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760", "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760" } ], "release_date": "2022-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin" }, { "cve": "CVE-2022-34177", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-07-04T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2103551" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Pipeline Input Step Plugin. This issue affects the code of the component Archive File Handler. The manipulation of the argument file with a malicious input leads to a directory traversal vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-34177" }, { "category": "external", "summary": "RHBZ#2103551", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103551" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-34177", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34177" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34177", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34177" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2705", "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2705" } ], "release_date": "2022-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin" }, { "cve": "CVE-2022-36881", "cwe": { "id": "CWE-322", "name": "Key Exchange without Entity Authentication" }, "discovery_date": "2022-08-03T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2114755" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36881" }, { "category": "external", "summary": "RHBZ#2114755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2114755" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36881", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36881" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-cm7j-p8hc-97vj", "url": "https://github.com/advisories/GHSA-cm7j-p8hc-97vj" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468" } ], "release_date": "2022-08-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client" }, { "cve": "CVE-2022-36882", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "discovery_date": "2022-08-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2116840" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Git Jenkins plugin. The affected versions of the Git Jenkins Plugin allow attackers to trigger the builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36882" }, { "category": "external", "summary": "RHBZ#2116840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116840" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36882", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36882" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36882", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36882" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" } ], "release_date": "2022-08-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git" }, { "cve": "CVE-2022-36883", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119656" } ], "notes": [ { "category": "description", "text": "A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Lack of authentication mechanism in Git Plugin webhook", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36883" }, { "category": "external", "summary": "RHBZ#2119656", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119656" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36883", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36883" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36883", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36883" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" } ], "release_date": "2022-07-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: Lack of authentication mechanism in Git Plugin webhook" }, { "cve": "CVE-2022-36884", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119657" } ], "notes": [ { "category": "description", "text": "The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Lack of authentication mechanism in Git Plugin webhook", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36884" }, { "category": "external", "summary": "RHBZ#2119657", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119657" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36884", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36884" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36884", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36884" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284" } ], "release_date": "2022-07-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: Lack of authentication mechanism in Git Plugin webhook" }, { "cve": "CVE-2022-36885", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119658" } ], "notes": [ { "category": "description", "text": "Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: Non-constant time webhook signature comparison in GitHub Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "known_not_affected": [ "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-36885" }, { "category": "external", "summary": "RHBZ#2119658", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119658" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36885", "url": "https://www.cve.org/CVERecord?id=CVE-2022-36885" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849", "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849" } ], "release_date": "2022-07-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-12T16:49:54+00:00", "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html", "product_ids": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0017" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch", "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: Non-constant time webhook signature comparison in GitHub Plugin" } ] }
ghsa-64mj-3p92-589v
Vulnerability from github
Published
2022-06-24 00:00
Modified
2022-12-05 23:29
Severity ?
Summary
Cross-site Scripting in Jenkins JUnit Plugin
Details
JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.
JUnit Plugin 1119.1121.vc43d0fc45561 applies the configured markup formatter to descriptions of test results.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "org.jenkins-ci.plugins:junit" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1119.1121.vc43d0fc45561" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2022-34176" ], "database_specific": { "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2022-07-05T22:56:33Z", "nvd_published_at": "2022-06-23T17:15:00Z", "severity": "HIGH" }, "details": "JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.\n\nJUnit Plugin 1119.1121.vc43d0fc45561 applies the configured markup formatter to descriptions of test results.", "id": "GHSA-64mj-3p92-589v", "modified": "2022-12-05T23:29:44Z", "published": "2022-06-24T00:00:31Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34176" }, { "type": "WEB", "url": "https://github.com/jenkinsci/junit-plugin/commit/c43d0fc455619dd652ec87939ac3d70d6134fea1" }, { "type": "PACKAGE", "url": "https://github.com/jenkinsci/junit-plugin" }, { "type": "WEB", "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "Cross-site Scripting in Jenkins JUnit Plugin" }
gsd-2022-34176
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2022-34176", "description": "Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.", "id": "GSD-2022-34176", "references": [ "https://access.redhat.com/errata/RHBA-2022:8582", "https://access.redhat.com/errata/RHSA-2022:6531", "https://access.redhat.com/errata/RHSA-2023:0017" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2022-34176" ], "details": "Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.", "id": "GSD-2022-34176", "modified": "2023-12-13T01:19:19.143530Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2022-34176", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Jenkins JUnit Plugin", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "status": "unaffected", "version": "1.53.0.1" }, { "lessThanOrEqual": "1119.va_a_5e9068da_d7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } } ] } } ] }, "vendor_name": "Jenkins project" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760", "refsource": "MISC", "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "(,1119.va_a_5e9068da_d7]", "affected_versions": "All versions up to 1119.va_a_5e9068da_d7", "cvss_v2": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "cwe_ids": [ "CWE-1035", "CWE-79", "CWE-79", "CWE-937" ], "date": "2022-07-05", "description": "Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.", "fixed_versions": [ "1119.1121.vc43d0fc45561" ], "identifier": "CVE-2022-34176", "identifiers": [ "GHSA-64mj-3p92-589v", "CVE-2022-34176" ], "not_impacted": "All versions after 1119.va_a_5e9068da_d7", "package_slug": "maven/org.jenkins-ci.plugins/junit", "pubdate": "2022-06-24", "solution": "Upgrade to version 1119.1121.vc43d0fc45561 or above.", "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2022-34176", "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760", "https://github.com/advisories/GHSA-64mj-3p92-589v" ], "uuid": "433259fd-4707-4179-a569-7c45c7cb083c" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:jenkins:junit:*:*:*:*:*:jenkins:*:*", "cpe_name": [], "versionEndIncluding": "1119.va_a_5e9068da_d7", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2022-34176" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-79" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760", "refsource": "CONFIRM", "tags": [ "Vendor Advisory" ], "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0" }, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 2.3, "impactScore": 2.7 } }, "lastModifiedDate": "2023-11-03T02:47Z", "publishedDate": "2022-06-23T17:15Z" } } }
wid-sec-w-2022-0445
Vulnerability from csaf_certbund
Published
2022-06-22 22:00
Modified
2023-02-22 23:00
Summary
Jenkins: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.
Angriff
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion.
Betroffene Betriebssysteme
- UNIX
- Linux
- Windows
- Sonstiges
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterst\u00fctzung bei Softwareentwicklungen aller Art.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-0445 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0445.json" }, { "category": "self", "summary": "WID-SEC-2022-0445 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0445" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0777 vom 2023-02-23", "url": "https://access.redhat.com/errata/RHSA-2023:0777" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0697 vom 2023-02-16", "url": "https://access.redhat.com/errata/RHSA-2023:0697" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0698 vom 2023-02-15", "url": "https://access.redhat.com/errata/RHSA-2023:0698" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0017 vom 2023-01-12", "url": "https://access.redhat.com/errata/RHSA-2023:0017" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:9110 vom 2023-01-06", "url": "https://access.redhat.com/errata/RHSA-2022:9110" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:9111 vom 2023-01-06", "url": "https://access.redhat.com/errata/RHSA-2022:9111" }, { "category": "external", "summary": "Jenkins Security Advisory vom 2022-06-22", "url": "https://www.jenkins.io/security/advisory/2022-06-22/" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:6531 vom 2022-09-21", "url": "https://access.redhat.com/errata/RHSA-2022:6531" } ], "source_lang": "en-US", "title": "Jenkins: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-02-22T23:00:00.000+00:00", "generator": { "date": "2024-02-15T16:49:53.685+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2022-0445", "initial_release_date": "2022-06-22T22:00:00.000+00:00", "revision_history": [ { "date": "2022-06-22T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2022-09-21T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-01-05T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-01-08T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-01-12T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-02-15T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-02-22T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Red Hat aufgenommen" } ], "status": "final", "version": "7" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Jenkins Jenkins weekly \u003c 2.356", "product": { "name": "Jenkins Jenkins weekly \u003c 2.356", "product_id": "T023600", "product_identification_helper": { "cpe": "cpe:/a:cloudbees:jenkins:weekly__2.356" } } }, { "category": "product_name", "name": "Jenkins Jenkins LTS \u003c 2.332.4", "product": { "name": "Jenkins Jenkins LTS \u003c 2.332.4", "product_id": "T023601", "product_identification_helper": { "cpe": "cpe:/a:cloudbees:jenkins:lts__2.332.4" } } }, { "category": "product_name", "name": "Jenkins Jenkins LTS \u003c 2.346.1", "product": { "name": "Jenkins Jenkins LTS \u003c 2.346.1", "product_id": "T023602", "product_identification_helper": { "cpe": "cpe:/a:cloudbees:jenkins:lts__2.346.1" } } } ], "category": "product_name", "name": "Jenkins" } ], "category": "vendor", "name": "Jenkins" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } }, { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift", "product": { "name": "Red Hat OpenShift", "product_id": "T008027", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:-" } } }, { "category": "product_name", "name": "Red Hat OpenShift Container Platform", "product": { "name": "Red Hat OpenShift Container Platform", "product_id": "T025202", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform" } } } ], "category": "product_name", "name": "OpenShift" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-2601", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2017-2601" }, { "cve": "CVE-2022-34170", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34170" }, { "cve": "CVE-2022-34171", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34171" }, { "cve": "CVE-2022-34172", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34172" }, { "cve": "CVE-2022-34173", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34173" }, { "cve": "CVE-2022-34174", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34174" }, { "cve": "CVE-2022-34175", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34175" }, { "cve": "CVE-2022-34176", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34176" }, { "cve": "CVE-2022-34177", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34177" }, { "cve": "CVE-2022-34178", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34178" }, { "cve": "CVE-2022-34179", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34179" }, { "cve": "CVE-2022-34180", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34180" }, { "cve": "CVE-2022-34181", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34181" }, { "cve": "CVE-2022-34182", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34182" }, { "cve": "CVE-2022-34183", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34183" }, { "cve": "CVE-2022-34184", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34184" }, { "cve": "CVE-2022-34185", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34185" }, { "cve": "CVE-2022-34186", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34186" }, { "cve": "CVE-2022-34187", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34187" }, { "cve": "CVE-2022-34188", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34188" }, { "cve": "CVE-2022-34189", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34189" }, { "cve": "CVE-2022-34190", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34190" }, { "cve": "CVE-2022-34191", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34191" }, { "cve": "CVE-2022-34192", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34192" }, { "cve": "CVE-2022-34193", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34193" }, { "cve": "CVE-2022-34194", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34194" }, { "cve": "CVE-2022-34195", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34195" }, { "cve": "CVE-2022-34196", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34196" }, { "cve": "CVE-2022-34197", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34197" }, { "cve": "CVE-2022-34198", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34198" }, { "cve": "CVE-2022-34199", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34199" }, { "cve": "CVE-2022-34200", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34200" }, { "cve": "CVE-2022-34201", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34201" }, { "cve": "CVE-2022-34202", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34202" }, { "cve": "CVE-2022-34203", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34203" }, { "cve": "CVE-2022-34204", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34204" }, { "cve": "CVE-2022-34205", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34205" }, { "cve": "CVE-2022-34206", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34206" }, { "cve": "CVE-2022-34207", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34207" }, { "cve": "CVE-2022-34208", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34208" }, { "cve": "CVE-2022-34209", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34209" }, { "cve": "CVE-2022-34210", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34210" }, { "cve": "CVE-2022-34211", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34211" }, { "cve": "CVE-2022-34212", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34212" }, { "cve": "CVE-2022-34213", "notes": [ { "category": "description", "text": "Es existieren mehrere Schwachstellen in Jenkins Core und verschiedenen Plugins. Zu diesen Plugins geh\u00f6ren: Agent Server Parameter Plugin, Beaker builder Plugin, Convertigo Mobile Platform Plugin, CRX Content Package Deployer Plugin, Date Parameter Plugin, Dynamic Extended, Choice Parameter Plugin, EasyQA Plugin, Embeddable Build Status Plugin, Filesystem List Parameter Plugin, Hidden Parameter Plugin, Image Tag Parameter Plugin, Jianliao Notification Plugin, JUnit Plugin, Maven Metadata Plugin for Jenkins CI server Plugin, Nested View Plugin, NS-ND Integration Performance Publisher Plugin, ontrack Jenkins Plugin, Package Version Plugin, Pipeline: Input Step Plugin, Readonly Parameter Plugin, Repository Connector Plugin, REST List Parameter Plugin, Sauce OnDemand Plugin, Squash TM Publisher (Squash4Jenkins) Plugin, Stash Branch Parameter Plugin, ThreadFix Plugin, vRealize Orchestrator Plugin, xUnit Plugin. Ein entfernter, anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren und Daten zu manipulieren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T008027", "67646", "T025202" ] }, "release_date": "2022-06-22T22:00:00Z", "title": "CVE-2022-34213" } ] }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.