Action not permitted
Modal body text goes here.
cve-2022-43410
Vulnerability from cvelistv5
▼ | URL | Tags | |
---|---|---|---|
jenkinsci-cert@googlegroups.com | http://www.openwall.com/lists/oss-security/2022/10/19/3 | Mailing List, Third Party Advisory | |
jenkinsci-cert@googlegroups.com | https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831 | Vendor Advisory |
▼ | Vendor | Product |
---|---|---|
Jenkins project | Jenkins Mercurial Plugin |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T13:32:57.390Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831" }, { "name": "[oss-security] 20221019 Multiple vulnerabilities in Jenkins plugins", "tags": [ "mailing-list", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2022/10/19/3" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Jenkins Mercurial Plugin", "vendor": "Jenkins project", "versions": [ { "lessThanOrEqual": "1251.va_b_121f184902", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access." } ], "providerMetadata": { "dateUpdated": "2023-10-24T14:25:37.381Z", "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins" }, "references": [ { "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831" }, { "name": "[oss-security] 20221019 Multiple vulnerabilities in Jenkins plugins", "tags": [ "mailing-list" ], "url": "http://www.openwall.com/lists/oss-security/2022/10/19/3" } ] } }, "cveMetadata": { "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2022-43410", "datePublished": "2022-10-19T00:00:00", "dateReserved": "2022-10-18T00:00:00", "dateUpdated": "2024-08-03T13:32:57.390Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-43410\",\"sourceIdentifier\":\"jenkinsci-cert@googlegroups.com\",\"published\":\"2022-10-19T16:15:10.660\",\"lastModified\":\"2023-11-01T20:54:41.857\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access.\"},{\"lang\":\"es\",\"value\":\"Jenkins Mercurial Plugin versiones 1251.va_b_121f184902 y anteriores, proporciona informaci\u00f3n sobre los trabajos que se activaron o programaron para el sondeo mediante su endpoint de webhook, incluidos los trabajos a los que el usuario no presenta permiso para acceder\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jenkins:mercurial:*:*:*:*:*:jenkins:*:*\",\"versionEndIncluding\":\"1251.va_b_121f184902\",\"matchCriteriaId\":\"8940A066-F705-4473-B642-AB732FBC7BDE\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2022/10/19/3\",\"source\":\"jenkinsci-cert@googlegroups.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831\",\"source\":\"jenkinsci-cert@googlegroups.com\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
wid-sec-w-2022-1804
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterst\u00fctzung bei Softwareentwicklungen aller Art.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- MacOS X\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-1804 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1804.json" }, { "category": "self", "summary": "WID-SEC-2022-1804 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1804" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:6172 vom 2023-10-30", "url": "https://access.redhat.com/errata/RHSA-2023:6172" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3198 vom 2023-05-18", "url": "https://access.redhat.com/errata/RHSA-2023:3198" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:1064 vom 2023-03-06", "url": "https://access.redhat.com/errata/RHSA-2023:1064" }, { "category": "external", "summary": "Jenkins Security Advisory vom 2022-10-19", "url": "https://www.jenkins.io/security/advisory/2022-10-19/" }, { "category": "external", "summary": "Github Security Advisory vom 2022-10-19", "url": "https://github.com/advisories/GHSA-4g29-r7vj-2rpv" }, { "category": "external", "summary": "Github Security Advisory vom 2022-10-19", "url": "https://github.com/advisories/GHSA-64r9-x74q-wxmh" }, { "category": "external", "summary": "Github Security Advisory vom 2022-10-19", "url": "https://github.com/advisories/GHSA-682j-2p53-xp5f" }, { "category": "external", "summary": "Github Security Advisory vom 2022-10-19", "url": "https://github.com/advisories/GHSA-73v5-w6fg-2m44" }, { "category": "external", "summary": "Github Security Advisory vom 2022-10-19", "url": "https://github.com/advisories/GHSA-7rrj-hqv6-fvpp" }, { "category": "external", "summary": "Github Security Advisory vom 2022-10-19", "url": "https://github.com/advisories/GHSA-8cxw-wvhc-p4x4" }, { "category": "external", "summary": "Github Security Advisory vom 2022-10-19", "url": "https://github.com/advisories/GHSA-f9f9-4r63-4qcc" }, { "category": "external", "summary": "Github Security Advisory vom 2022-10-19", "url": "https://github.com/advisories/GHSA-g975-f26h-93g8" }, { "category": "external", "summary": "Github Security Advisory vom 2022-10-19", "url": "https://github.com/advisories/GHSA-px4x-hjm5-w8x3" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0560 vom 2023-02-08", "url": "https://access.redhat.com/errata/RHSA-2023:0560" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:0777 vom 2023-02-23", "url": "https://access.redhat.com/errata/RHSA-2023:0777" } ], "source_lang": "en-US", "title": "Jenkins Plugins: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-10-30T23:00:00.000+00:00", "generator": { "date": "2024-02-15T17:01:20.915+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2022-1804", "initial_release_date": "2022-10-19T22:00:00.000+00:00", "revision_history": [ { "date": "2022-10-19T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-02-08T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-02-22T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-03-06T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-05-18T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-10-30T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Red Hat aufgenommen" } ], "status": "final", "version": "6" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Jenkins Jenkins plugins", "product": { "name": "Jenkins Jenkins plugins", "product_id": "T013614", "product_identification_helper": { "cpe": "cpe:/a:cloudbees:jenkins:plugins" } } } ], "category": "vendor", "name": "Jenkins" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } }, { "category": "product_name", "name": "Red Hat OpenShift container platform 4.0.51", "product": { "name": "Red Hat OpenShift container platform 4.0.51", "product_id": "T026183", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform_4.0.51" } } } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-2601", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2017-2601" }, { "cve": "CVE-2022-43401", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43401" }, { "cve": "CVE-2022-43402", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43402" }, { "cve": "CVE-2022-43403", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43403" }, { "cve": "CVE-2022-43404", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43404" }, { "cve": "CVE-2022-43405", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43405" }, { "cve": "CVE-2022-43406", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43406" }, { "cve": "CVE-2022-43407", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43407" }, { "cve": "CVE-2022-43408", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43408" }, { "cve": "CVE-2022-43409", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43409" }, { "cve": "CVE-2022-43410", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43410" }, { "cve": "CVE-2022-43411", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43411" }, { "cve": "CVE-2022-43412", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43412" }, { "cve": "CVE-2022-43413", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43413" }, { "cve": "CVE-2022-43414", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43414" }, { "cve": "CVE-2022-43415", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43415" }, { "cve": "CVE-2022-43416", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43416" }, { "cve": "CVE-2022-43417", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43417" }, { "cve": "CVE-2022-43418", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43418" }, { "cve": "CVE-2022-43419", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43419" }, { "cve": "CVE-2022-43420", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43420" }, { "cve": "CVE-2022-43421", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43421" }, { "cve": "CVE-2022-43422", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43422" }, { "cve": "CVE-2022-43423", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43423" }, { "cve": "CVE-2022-43424", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43424" }, { "cve": "CVE-2022-43425", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43425" }, { "cve": "CVE-2022-43426", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43426" }, { "cve": "CVE-2022-43427", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43427" }, { "cve": "CVE-2022-43428", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43428" }, { "cve": "CVE-2022-43429", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43429" }, { "cve": "CVE-2022-43430", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43430" }, { "cve": "CVE-2022-43431", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43431" }, { "cve": "CVE-2022-43432", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43432" }, { "cve": "CVE-2022-43433", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43433" }, { "cve": "CVE-2022-43434", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43434" }, { "cve": "CVE-2022-43435", "notes": [ { "category": "description", "text": "In mehrere Jenkins Plugins existieren Schwachstellen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T026183", "67646", "T013614" ] }, "release_date": "2022-10-19T22:00:00Z", "title": "CVE-2022-43435" } ] }
rhsa-2023_1064
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for Jenkins and Jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.12.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron.\n\nSecurity Fix(es):\n\n* jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin (CVE-2022-43401)\n\n* jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin (CVE-2022-43402)\n\n* jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin (CVE-2022-43403)\n\n* jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin (CVE-2022-43404)\n\n* jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin (CVE-2022-43405)\n\n* jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin (CVE-2022-43406)\n\n* Pipeline Shared Groovy Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin (CVE-2022-29047)\n\n* jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin (CVE-2022-43407)\n\n* mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n\n* Jenkins plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin (CVE-2022-30952)\n\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n\n* jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin (CVE-2022-43408)\n\n* jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin (CVE-2022-43409)\n\n* jenkins-plugin/mercurial: Webhook endpoint discloses job names to unauthorized users in Mercurial Plugin (CVE-2022-43410)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1064", "url": "https://access.redhat.com/errata/RHSA-2023:1064" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "2074855", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074855" }, { "category": "external", "summary": "2119645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2136369", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136369" }, { "category": "external", "summary": "2136370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136370" }, { "category": "external", "summary": "2136374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136374" }, { "category": "external", "summary": "2136379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136379" }, { "category": "external", "summary": "2136381", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136381" }, { "category": "external", "summary": "2136382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136382" }, { "category": "external", "summary": "2136383", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136383" }, { "category": "external", "summary": "2136386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136386" }, { "category": "external", "summary": "2136388", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136388" }, { "category": "external", "summary": "2136391", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136391" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1064.json" } ], "title": "Red Hat Security Advisory: OpenShift Developer Tools and Services for OCP 4.12 security update", "tracking": { "current_release_date": "2024-11-06T02:33:44+00:00", "generator": { "date": "2024-11-06T02:33:44+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:1064", "initial_release_date": "2023-03-06T09:01:46+00:00", "revision_history": [ { "date": "2023-03-06T09:01:46+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-06T09:01:46+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T02:33:44+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "OpenShift Developer Tools and Services for OCP 4.12", "product": { "name": "OpenShift Developer Tools and Services for OCP 4.12", "product_id": "8Base-OCP-Tools-4.12", "product_identification_helper": { "cpe": "cpe:/a:redhat:ocp_tools:4.12::el8" } } } ], "category": "product_family", "name": "OpenShift Jenkins" }, { "branches": [ { "category": "product_version", "name": "jenkins-0:2.361.4.1675702346-3.el8.src", "product": { "name": "jenkins-0:2.361.4.1675702346-3.el8.src", "product_id": "jenkins-0:2.361.4.1675702346-3.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.361.4.1675702346-3.el8?arch=src" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.12.1675702407-1.el8.src", "product": { "name": "jenkins-2-plugins-0:4.12.1675702407-1.el8.src", "product_id": "jenkins-2-plugins-0:4.12.1675702407-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.12.1675702407-1.el8?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jenkins-0:2.361.4.1675702346-3.el8.noarch", "product": { "name": "jenkins-0:2.361.4.1675702346-3.el8.noarch", "product_id": "jenkins-0:2.361.4.1675702346-3.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins@2.361.4.1675702346-3.el8?arch=noarch" } } }, { "category": "product_version", "name": "jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "product": { "name": "jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "product_id": "jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.12.1675702407-1.el8?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.361.4.1675702346-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.12", "product_id": "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch" }, "product_reference": "jenkins-0:2.361.4.1675702346-3.el8.noarch", "relates_to_product_reference": "8Base-OCP-Tools-4.12" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-0:2.361.4.1675702346-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.12", "product_id": "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" }, "product_reference": "jenkins-0:2.361.4.1675702346-3.el8.src", "relates_to_product_reference": "8Base-OCP-Tools-4.12" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.12", "product_id": "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch" }, "product_reference": "jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "relates_to_product_reference": "8Base-OCP-Tools-4.12" }, { "category": "default_component_of", "full_product_name": { "name": "jenkins-2-plugins-0:4.12.1675702407-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.12", "product_id": "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" }, "product_reference": "jenkins-2-plugins-0:4.12.1675702407-1.el8.src", "relates_to_product_reference": "8Base-OCP-Tools-4.12" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-29047", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "discovery_date": "2022-04-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2074855" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Jenkins Pipeline: Shared Groovy Libraries plugin. The Jenkins Pipeline: Shared Groovy Libraries plugin allows attackers to submit pull requests. However, the attacker cannot commit directly to the configured Source Control Management (SCM) to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even with the Pipeline configured not to trust them.", "title": "Vulnerability description" }, { "category": "summary", "text": "Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-29047" }, { "category": "external", "summary": "RHBZ#2074855", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074855" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29047" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951", "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951" } ], "release_date": "2022-04-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin" }, { "cve": "CVE-2022-30952", "cwe": { "id": "CWE-668", "name": "Exposure of Resource to Wrong Sphere" }, "discovery_date": "2022-08-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2119645" } ], "notes": [ { "category": "description", "text": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-30952" }, { "category": "external", "summary": "RHBZ#2119645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30952", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30952" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714", "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714" } ], "release_date": "2022-05-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-43401", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136381" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43401" }, { "category": "external", "summary": "RHBZ#2136381", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136381" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43401", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43401" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43401", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43401" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin" }, { "cve": "CVE-2022-43402", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136379" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43402" }, { "category": "external", "summary": "RHBZ#2136379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136379" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43402", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43402" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43402", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43402" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin" }, { "cve": "CVE-2022-43403", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136382" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43403" }, { "category": "external", "summary": "RHBZ#2136382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136382" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43403", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43403" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43403", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43403" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin" }, { "cve": "CVE-2022-43404", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136383" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43404" }, { "category": "external", "summary": "RHBZ#2136383", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136383" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43404", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43404" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43404", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43404" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin" }, { "cve": "CVE-2022-43405", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136374" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43405" }, { "category": "external", "summary": "RHBZ#2136374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136374" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43405", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43405" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43405", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43405" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin" }, { "cve": "CVE-2022-43406", "cwe": { "id": "CWE-693", "name": "Protection Mechanism Failure" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136370" } ], "notes": [ { "category": "description", "text": "A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43406" }, { "category": "external", "summary": "RHBZ#2136370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136370" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43406", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43406" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43406", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43406" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(2)" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin" }, { "cve": "CVE-2022-43407", "cwe": { "id": "CWE-838", "name": "Inappropriate Encoding for Output Context" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136386" } ], "notes": [ { "category": "description", "text": "A cross-site request forgery (CSRF) vulnerability was found in a Jenkins plugin. This issue may allow an unauthenticated attacker to access Jenkins builds, bypassing CSRF protections. This could compromise the integrity, availability, and confidentiality of Jenkins.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43407" }, { "category": "external", "summary": "RHBZ#2136386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136386" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43407", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43407" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43407", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43407" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin" }, { "cve": "CVE-2022-43408", "cwe": { "id": "CWE-838", "name": "Inappropriate Encoding for Output Context" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136388" } ], "notes": [ { "category": "description", "text": "A Cross-site request forgery (CSRF) vulnerability was found in a Jenkins plugin. This issue may allow an authenticated attacker to access Jenkins builds, bypassing CSRF protections.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43408" }, { "category": "external", "summary": "RHBZ#2136388", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136388" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43408", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43408" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43408", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43408" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2828" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin" }, { "cve": "CVE-2022-43409", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136391" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability was found in a Jenkins plugin. This issue may allow an authenticated remote attacker to create Pipelines.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43409" }, { "category": "external", "summary": "RHBZ#2136391", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136391" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43409", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43409" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43409", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43409" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2881" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin" }, { "cve": "CVE-2022-43410", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2022-10-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2136369" } ], "notes": [ { "category": "description", "text": "An information leak was found in a Jenkins plugin. This issue could allow an unauthenticated remote attacker to issue GET requests. The greatest impact is to confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "jenkins-plugin/mercurial: Webhook endpoint discloses job names to unauthorized users in Mercurial Plugin", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-43410" }, { "category": "external", "summary": "RHBZ#2136369", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136369" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-43410", "url": "https://www.cve.org/CVERecord?id=CVE-2022-43410" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-43410", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43410" }, { "category": "external", "summary": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831" } ], "release_date": "2022-10-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jenkins-plugin/mercurial: Webhook endpoint discloses job names to unauthorized users in Mercurial Plugin" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "known_not_affected": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-06T09:01:46+00:00", "details": "For important instructions on how to upgrade your cluster and fully apply this asynchronous errata update in OpenShift Container Platform 4.12, see the following documentation, which will be updated shortly for this release:\n\nhttps://docs.openshift.com/container-platform/4.12/cicd/jenkins/important-changes-to-openshift-jenkins-images.html", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1064" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-0:2.361.4.1675702346-3.el8.src", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.noarch", "8Base-OCP-Tools-4.12:jenkins-2-plugins-0:4.12.1675702407-1.el8.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" } ] }
ghsa-j7pg-863g-22p6
Vulnerability from github
Mercurial Plugin provides a webhook endpoint at /mercurial/notifyCommit
that can be used to notify Jenkins of changes to an SCM repository. This endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. It can be accessed with GET requests and without authentication.
In Mercurial Plugin 1251.va_b_121f184902 and earlier, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Mercurial repository URLs to obtain information about the existence of jobs configured with this Mercurial repository.
Mercurial Plugin 1260.vdfb_723cdcc81 does not provide the names of jobs for which polling is triggered unless the user has the appropriate Item/Read permission.
{ "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c 1260.vdfb" }, "package": { "ecosystem": "Maven", "name": "org.jenkins-ci.plugins:mercurial" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1260.vdfb_723cdcc81" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2022-43410" ], "database_specific": { "cwe_ids": [ "CWE-200" ], "github_reviewed": true, "github_reviewed_at": "2022-10-19T20:27:28Z", "nvd_published_at": "2022-10-19T16:15:00Z", "severity": "MODERATE" }, "details": "Mercurial Plugin provides a webhook endpoint at `/mercurial/notifyCommit` that can be used to notify Jenkins of changes to an SCM repository. This endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. It can be accessed with GET requests and without authentication.\n\nIn Mercurial Plugin 1251.va_b_121f184902 and earlier, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Mercurial repository URLs to obtain information about the existence of jobs configured with this Mercurial repository.\n\nMercurial Plugin 1260.vdfb_723cdcc81 does not provide the names of jobs for which polling is triggered unless the user has the appropriate Item/Read permission.", "id": "GHSA-j7pg-863g-22p6", "modified": "2022-12-16T17:17:55Z", "published": "2022-10-19T19:00:18Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43410" }, { "type": "WEB", "url": "https://github.com/jenkinsci/mercurial-plugin/commit/dfb723cdcc815875cdf63abd32e314ced5e95ac9" }, { "type": "PACKAGE", "url": "https://github.com/jenkinsci/mercurial-plugin" }, { "type": "WEB", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2022/10/19/3" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ], "summary": "Webhook endpoint discloses job names to unauthorized users in Jenkins Mercurial Plugin" }
gsd-2022-43410
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2022-43410", "id": "GSD-2022-43410", "references": [ "https://access.redhat.com/errata/RHSA-2023:1064" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2022-43410" ], "details": "Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access.", "id": "GSD-2022-43410", "modified": "2023-12-13T01:19:31.601565Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2022-43410", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Jenkins Mercurial Plugin", "version": { "version_data": [ { "version_affected": "\u003c=", "version_name": "unspecified", "version_value": "1251.va_b_121f184902" } ] } } ] }, "vendor_name": "Jenkins project" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831", "refsource": "MISC", "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831" }, { "name": "http://www.openwall.com/lists/oss-security/2022/10/19/3", "refsource": "MISC", "url": "http://www.openwall.com/lists/oss-security/2022/10/19/3" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "(,1251.va_b_121f184902]", "affected_versions": "All versions up to 1251.va_b_121f184902", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cwe_ids": [ "CWE-1035", "CWE-937" ], "date": "2023-07-06", "description": "Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access.", "fixed_versions": [], "identifier": "CVE-2022-43410", "identifiers": [ "CVE-2022-43410", "GHSA-j7pg-863g-22p6" ], "not_impacted": "", "package_slug": "maven/org.jenkins-ci.plugins/mercurial", "pubdate": "2022-10-19", "solution": "Unfortunately, there is no solution available yet.", "title": "Exposure of Sensitive Information to an Unauthorized Actor", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2022-43410", "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831", "http://www.openwall.com/lists/oss-security/2022/10/19/3", "https://github.com/advisories/GHSA-j7pg-863g-22p6" ], "uuid": "9b6656b7-8c2a-4a5b-b3ed-3e85777d1d9a" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:jenkins:mercurial:*:*:*:*:*:jenkins:*:*", "cpe_name": [], "versionEndIncluding": "1251.va_b_121f184902", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2022-43410" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "NVD-CWE-Other" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831", "refsource": "CONFIRM", "tags": [ "Vendor Advisory" ], "url": "https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831" }, { "name": "[oss-security] 20221019 Multiple vulnerabilities in Jenkins plugins", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2022/10/19/3" } ] } }, "impact": { "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 1.4 } }, "lastModifiedDate": "2023-11-01T20:54Z", "publishedDate": "2022-10-19T16:15Z" } } }
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.