Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-14813 (GCVE-0-2025-14813)
Vulnerability from cvelistv5 – Published: 2026-04-15 08:56 – Updated: 2026-09-04 12:04
VLAI
EPSS
VEX
Title
GOSTCTR implementation unable to process more than 255 blocks correctly
Summary
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).
This vulnerability is associated with program files G3413CTRBlockCipher.
This issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-15 13:19 UTC
CWE
- CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
Assigner
References
30 references
Impacted products
58 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Legion of the Bouncy Castle Inc. | BC-JAVA |
Affected:
1.59 , < 1.80.2
(maven)
Affected: 1.81 , < 1.81.1 (maven) Affected: 1.82 , < 1.84 (maven) |
guessed | |
| Red Hat | Red Hat AMQ Broker 7.12.7 |
cpe:/a:redhat:amq_broker:7.12
|
||
| Red Hat | Red Hat AMQ Broker 7.13.5 |
cpe:/a:redhat:amq_broker:7.13
|
||
| Red Hat | Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 |
cpe:/a:redhat:apache_camel_quarkus:3.27
|
||
| Red Hat | Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 |
Unaffected:
debug-jdk15on , < *
(rpm)
cpe:/a:redhat:apache_camel_spring_boot:4.18 |
||
| Red Hat | Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 |
cpe:/a:redhat:apache_camel_spring_boot:4.18
|
||
| Red Hat | Red Hat build of Quarkus 3.20.6.SP1 |
cpe:/a:redhat:quarkus:3.20::el8
|
||
| Red Hat | Red Hat build of Quarkus 3.27.3.SP1 |
cpe:/a:redhat:quarkus:3.27::el8
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4.25 |
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.16.0-22.redhat_00057.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.3.14-11.SP11_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:1.5.26-2.Final_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.18.8-1.redhat_00003.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:5.0.31-3.SP2_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:1.10.0-46.Final_redhat_00044.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:4.1.135-1.Final_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.5.5-30.SP12_redhat_00020.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.5.5-24.SP12_redhat_00016.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.2.40-2.SP3_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:7.4.25-2.GA_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 |
Unaffected:
ext-jdk15on , < *
(rpm)
Unaffected: ext-jdk18on , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 |
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 |
Unaffected:
0:1.84.0-1.redhat_00001.1.el8eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 |
Unaffected:
0:1.84.0-1.redhat_00001.1.el9eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.12 |
Unaffected:
1786628667 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.12::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.13 |
Unaffected:
1786628681 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.13::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.14 |
Unaffected:
1786533561 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.14::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.15 |
Unaffected:
1786533565 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.15::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 4.16 |
Unaffected:
1787125166 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.16::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.17 |
Unaffected:
1787124635 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.17::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.18 |
Unaffected:
1787125069 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.18::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.19 |
Unaffected:
1787124632 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.19::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.20 |
Unaffected:
1787124925 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.20::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.21 |
Unaffected:
1787125311 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.21::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 4.22 |
Unaffected:
1787124779 , < *
(rpm)
cpe:/a:redhat:ocp_tools:4.22::el9 |
||
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1780069506 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 |
Unaffected:
1779528224 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.28::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 |
Unaffected:
1779359423 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.28::el9 |
||
| Red Hat | Cryostat 4 |
cpe:/a:redhat:cryostat:4
|
||
| Red Hat | OpenShift Developer Tools and Services |
cpe:/a:redhat:ocp_tools
|
||
| Red Hat | Red Hat AMQ Broker 7 |
cpe:/a:redhat:amq_broker:7
|
||
| Red Hat | Red Hat AMQ Clients |
cpe:/a:redhat:amq_clients:2023
|
||
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 |
cpe:/a:redhat:camel_quarkus:3
|
||
| Red Hat | Red Hat build of Apicurio Registry 3 |
cpe:/a:redhat:apicurio_registry:3
|
||
| Red Hat | Red Hat build of Debezium 3 |
cpe:/a:redhat:debezium:3
|
||
| Red Hat | Red Hat Build of Keycloak |
cpe:/a:redhat:build_keycloak:
|
||
| Red Hat | Red Hat Data Grid 8 |
cpe:/a:redhat:jboss_data_grid:8
|
||
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
||
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
||
| Red Hat | Red Hat Fuse 7 |
cpe:/a:redhat:jboss_fuse:7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 |
cpe:/a:redhat:jboss_enterprise_application_platform:7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack |
cpe:/a:redhat:jbosseapxp
|
||
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai
|
||
| Red Hat | Red Hat Process Automation 7 |
cpe:/a:redhat:jboss_enterprise_bpms_platform:7
|
||
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6
|
||
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
||
| Red Hat | streams for Apache Kafka 2 |
cpe:/a:redhat:amq_streams:2
|
||
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14813",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T13:19:43.094033Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T13:19:49.520Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7.12"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat AMQ Broker 7.12.7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7.13"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat AMQ Broker 7.13.5",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_quarkus:3.27"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat Build of Apache Camel 4.14 for Quarkus 3.27",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "affected",
"packageName": "bcprov",
"product": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "debug-jdk15on",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-lts8on",
"product": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.20::el8"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat build of Quarkus 3.20.6.SP1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.27::el8"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat build of Quarkus 3.27.3.SP1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
],
"defaultStatus": "unaffected",
"product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-activemq-artemis",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.16.0-22.redhat_00057.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-glassfish-jsf",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-ironjacamar",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-annotations",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-core",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-databind",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-jaxrs-providers",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-base",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-java8",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-remoting",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-server-migration",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty-transport-native-epoll",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-bindings",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-federation",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-undertow",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-wildfly",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "affected",
"packageName": "bcprov",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "ext-jdk15on",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "ext-jdk18on",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk12",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15to18",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
],
"defaultStatus": "affected",
"packageName": "eap8-bouncycastle",
"product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.84.0-1.redhat_00001.1.el8eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "affected",
"packageName": "eap8-bouncycastle",
"product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.84.0-1.redhat_00001.1.el9eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.12::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786628667",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.13::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786628681",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.14::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786533561",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.15::el8"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services 4.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786533565",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.16::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125166",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.17::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.17",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124635",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.18::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125069",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124632",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.20::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.20",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124925",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787125311",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ocp_tools:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel9",
"product": "OpenShift Developer Tools and Services 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787124779",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-modelmesh-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780069506",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/openvsx-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779528224",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/pluginregistry-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779359423",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"packageName": "jenkins",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"packageName": "jenkins-2-plugins",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_clients:2023"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat AMQ Clients",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_clients:2023"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat AMQ Clients",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-lts8on",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "bcprov-ext-jdk15on",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "bcprov-lts8on",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15to18",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "pki-core:10.6/resteasy",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "pki-deps:10.6/resteasy",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "jmc",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "resteasy",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-debug-jdk18on",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-ext-jdk15on",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-ext-jdk18on",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15to18",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk16",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk12",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat JBoss Enterprise Application Platform 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-ext-jdk15on",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-ext-jdk18on",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk12",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15to18",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on-1.83.0.redhat-00001.jar",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-modelmesh-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15to18",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite:el8/candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk15on",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "affected",
"packageName": "bcprov-jdk18on",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk15on",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "unaffected",
"packageName": "bcprov-jdk18on",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-15T08:56:34.057Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-327",
"description": "Use of a Broken or Risky Cryptographic Algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T12:04:50.964Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"name": "RHBZ#2458640",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18054"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18055"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60247"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60239"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60246"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14276"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14272"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13631"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18059"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24977"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21772"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17668"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11720"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11721"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
},
{
"lang": "en",
"value": "RHSA-2026:18054: Red Hat JBoss EAP 8.1 for RHEL 8"
},
{
"lang": "en",
"value": "RHSA-2026:18055: Red Hat JBoss EAP 8.1 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:60247: OpenShift Developer Tools and Services 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:60249: OpenShift Developer Tools and Services 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:60248: OpenShift Developer Tools and Services 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:60239: OpenShift Developer Tools and Services 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:60251: OpenShift Developer Tools and Services 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:60246: OpenShift Developer Tools and Services 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:60250: OpenShift Developer Tools and Services 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:60252: OpenShift Developer Tools and Services 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:60259: OpenShift Developer Tools and Services 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:60254: OpenShift Developer Tools and Services 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:60256: OpenShift Developer Tools and Services 4.22"
},
{
"lang": "en",
"value": "RHSA-2026:14276: Red Hat AMQ Broker 7.12.7"
},
{
"lang": "en",
"value": "RHSA-2026:14272: Red Hat AMQ Broker 7.13.5"
},
{
"lang": "en",
"value": "RHSA-2026:13631: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27"
},
{
"lang": "en",
"value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
},
{
"lang": "en",
"value": "RHSA-2026:18059: Red Hat JBoss Enterprise Application Platform 8.1"
},
{
"lang": "en",
"value": "RHSA-2026:24977: Red Hat OpenShift AI 2.25"
},
{
"lang": "en",
"value": "RHSA-2026:21772: Red Hat OpenShift Dev Spaces 3.28"
},
{
"lang": "en",
"value": "RHSA-2026:17668: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
},
{
"lang": "en",
"value": "RHSA-2026:11720: Red Hat build of Quarkus 3.20.6.SP1"
},
{
"lang": "en",
"value": "RHSA-2026:11721: Red Hat build of Quarkus 3.27.3.SP1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-15T10:01:27.769Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-15T08:56:34.057Z",
"value": "Made public."
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/",
"defaultStatus": "unaffected",
"modules": [
"core"
],
"packageName": "bcprov",
"platforms": [
"all"
],
"product": "BC-JAVA",
"programFiles": [
"G3413CTRBlockCipher"
],
"repo": "https://github.com/bcgit/bc-java",
"vendor": "Legion of the Bouncy Castle Inc.",
"versions": [
{
"lessThan": "1.80.2",
"status": "affected",
"version": "1.59",
"versionType": "maven"
},
{
"lessThan": "1.81.1",
"status": "affected",
"version": "1.81",
"versionType": "maven"
},
{
"lessThan": "1.84",
"status": "affected",
"version": "1.82",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "XlabAI Team of Tencent Xuanwu Lab"
},
{
"lang": "en",
"type": "finder",
"value": "Atuin Automated Vulnerability Discovery Engine"
},
{
"lang": "en",
"type": "finder",
"value": "Lili Tang, Guannan Wang, and Guancheng Li"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": ": Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).\u003cp\u003e This vulnerability is associated with program files G3413CTRBlockCipher.\u003c/p\u003e\u003cp\u003eThis issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.\u003c/p\u003e"
}
],
"value": ": Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).\n\n This vulnerability is associated with program files G3413CTRBlockCipher.\n\n\n\nThis issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-327",
"description": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T23:15:49.105Z",
"orgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
"shortName": "bcorg"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
},
{
"tags": [
"patch"
],
"url": "https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f"
},
{
"tags": [
"patch"
],
"url": "https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "GOSTCTR implementation unable to process more than 255 blocks correctly",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "91579145-5d7b-4cc5-b925-a0262ff19630",
"assignerShortName": "bcorg",
"cveId": "CVE-2025-14813",
"datePublished": "2026-04-15T08:56:34.057Z",
"dateReserved": "2025-12-17T00:17:44.229Z",
"dateUpdated": "2026-09-04T12:04:50.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-14813",
"date": "2026-09-06",
"epss": "0.00313",
"percentile": "0.238"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-14813\",\"sourceIdentifier\":\"91579145-5d7b-4cc5-b925-a0262ff19630\",\"published\":\"2026-04-15T10:16:38.243\",\"lastModified\":\"2026-09-04T13:17:54.733\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\": Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).\\n\\n This vulnerability is associated with program files G3413CTRBlockCipher.\\n\\n\\n\\nThis issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.\"}],\"affected\":[{\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\",\"affectedData\":[{\"vendor\":\"Legion of the Bouncy Castle Inc.\",\"product\":\"BC-JAVA\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://www.bouncycastle.org/download/bouncy-castle-java/\",\"packageName\":\"bcprov\",\"modules\":[\"core\"],\"platforms\":[\"all\"],\"programFiles\":[\"G3413CTRBlockCipher\"],\"repo\":\"https://github.com/bcgit/bc-java\",\"versions\":[{\"version\":\"1.59\",\"lessThan\":\"1.80.2\",\"versionType\":\"maven\",\"status\":\"affected\"},{\"version\":\"1.81\",\"lessThan\":\"1.81.1\",\"versionType\":\"maven\",\"status\":\"affected\"},{\"version\":\"1.82\",\"lessThan\":\"1.84\",\"versionType\":\"maven\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7.12.7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7.12\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7.13.5\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7.13\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Apache Camel 4.14 for Quarkus 3.27\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:apache_camel_quarkus:3.27\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"],\"versions\":[{\"version\":\"debug-jdk15on\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-lts8on\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Quarkus 3.20.6.SP1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:quarkus:3.20::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Quarkus 3.27.3.SP1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:quarkus:3.27::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4.25\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-activemq-artemis\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.16.0-22.redhat_00057.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-glassfish-jsf\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.3.14-11.SP11_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-ironjacamar\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:1.5.26-2.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-annotations\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-core\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-databind\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-jaxrs-providers\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-modules-base\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-modules-java8\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jboss-remoting\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:5.0.31-3.SP2_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jboss-server-migration\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:1.10.0-46.Final_redhat_00044.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-netty\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:4.1.135-1.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-netty-transport-native-epoll\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:4.1.135-1.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-picketlink-bindings\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.5.5-30.SP12_redhat_00020.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-picketlink-federation\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.5.5-24.SP12_redhat_00016.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-undertow\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.2.40-2.SP3_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-wildfly\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:7.4.25-2.GA_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"],\"versions\":[{\"version\":\"ext-jdk15on\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"ext-jdk18on\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk12\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15to18\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap8-bouncycastle\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8\"],\"versions\":[{\"version\":\"0:1.84.0-1.redhat_00001.1.el8eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap8-bouncycastle\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"],\"versions\":[{\"version\":\"0:1.84.0-1.redhat_00001.1.el9eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.12::el8\"],\"versions\":[{\"version\":\"1786628667\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.13\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.13::el8\"],\"versions\":[{\"version\":\"1786628681\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.14::el8\"],\"versions\":[{\"version\":\"1786533561\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.15::el8\"],\"versions\":[{\"version\":\"1786533565\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.16::el9\"],\"versions\":[{\"version\":\"1787125166\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.17\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.17::el9\"],\"versions\":[{\"version\":\"1787124635\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.18::el9\"],\"versions\":[{\"version\":\"1787125069\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.19::el9\"],\"versions\":[{\"version\":\"1787124632\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.20\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.20::el9\"],\"versions\":[{\"version\":\"1787124925\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.21\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.21::el9\"],\"versions\":[{\"version\":\"1787125311\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ocp-tools-4/jenkins-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools:4.22::el9\"],\"versions\":[{\"version\":\"1787124779\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-modelmesh-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1780069506\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.28\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/openvsx-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"],\"versions\":[{\"version\":\"1779528224\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.28\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/pluginregistry-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"],\"versions\":[{\"version\":\"1779359423\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:cryostat:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jenkins\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jenkins-2-plugins\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Clients\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:amq_clients:2023\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Clients\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:amq_clients:2023\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4 for Quarkus 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:camel_quarkus:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:apicurio_registry:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-lts8on\",\"cpes\":[\"cpe:/a:redhat:apicurio_registry:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-ext-jdk15on\",\"cpes\":[\"cpe:/a:redhat:debezium:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:debezium:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-lts8on\",\"cpes\":[\"cpe:/a:redhat:debezium:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Keycloak\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15to18\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pki-core:10.6/resteasy\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pki-deps:10.6/resteasy\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jmc\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"resteasy\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-debug-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-ext-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-ext-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15to18\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk16\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk12\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-ext-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-ext-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk12\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15to18\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on-1.83.0.redhat-00001.jar\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-modelmesh-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15to18\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"candlepin\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite:el8/candlepin\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:amq_streams:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:amq_streams:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk15on\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bcprov-jdk18on\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Red\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"RED\"}}],\"cvssMetricV31\":[{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-15T13:19:43.094033Z\",\"id\":\"CVE-2025-14813\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-327\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-327\"}]}],\"references\":[{\"url\":\"https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3\",\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\"},{\"url\":\"https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f\",\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\"},{\"url\":\"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813\",\"source\":\"91579145-5d7b-4cc5-b925-a0262ff19630\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11720\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11721\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13631\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14272\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14276\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17668\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18054\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18055\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18059\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21772\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24977\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53644\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53806\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60239\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60246\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60247\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60248\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60249\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60250\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60251\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60252\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60254\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60256\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:60259\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2025-14813\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2458640\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-09-06T21:41:18+00:00",
"cve": "CVE-2025-14813",
"id": "CVE-2025-14813",
"initial_release_date": "2025-01-01T00:00:00+00:00",
"product_status:fixed": "171",
"product_status:known_affected": "28",
"product_status:known_not_affected": "537",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-09-02T01:20:42Z",
"cve": "CVE-2025-14813",
"id": "CVE-2025-14813",
"initial_release_date": "2026-04-17T12:10:41Z",
"product_status:known_affected": "40",
"product_status:recommended": "100",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2025-14813",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-14813.json",
"version": "9"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:amq_broker:7.12\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7.12.7\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7.13\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7.13.5\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_quarkus:3.27\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Apache Camel 4.14 for Quarkus 3.27\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"debug-jdk15on\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"bcprov\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\", \"packageName\": \"bcprov-lts8on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:3.20::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus 3.20.6.SP1\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:3.27::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus 3.27.3.SP1\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4.25\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.16.0-22.redhat_00057.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-activemq-artemis\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.3.14-11.SP11_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-glassfish-jsf\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.5.26-2.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-ironjacamar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-annotations\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-databind\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-jaxrs-providers\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-modules-base\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-modules-java8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:5.0.31-3.SP2_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jboss-remoting\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.10.0-46.Final_redhat_00044.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jboss-server-migration\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.1.135-1.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.1.135-1.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-netty-transport-native-epoll\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.5.5-30.SP12_redhat_00020.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-picketlink-bindings\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.5.5-24.SP12_redhat_00016.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-picketlink-federation\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.2.40-2.SP3_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-undertow\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:7.4.25-2.GA_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-wildfly\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"ext-jdk15on\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"ext-jdk18on\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"bcprov\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"packageName\": \"bcprov-jdk12\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"packageName\": \"bcprov-jdk15\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"packageName\": \"bcprov-jdk15to18\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.84.0-1.redhat_00001.1.el8eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap8-bouncycastle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.84.0-1.redhat_00001.1.el9eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap8-bouncycastle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786628667\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.13::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.13\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786628681\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.14::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533561\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1786533565\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125166\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.17\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124635\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125069\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124632\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.20\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124925\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.21::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.21\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787125311\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1787124779\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ocp-tools-4/jenkins-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780069506\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-modelmesh-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.28\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779528224\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/openvsx-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.28\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779359423\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/pluginregistry-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"packageName\": \"jenkins\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"packageName\": \"jenkins-2-plugins\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_clients:2023\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Clients\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_clients:2023\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Clients\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:camel_quarkus:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4 for Quarkus 3\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:apicurio_registry:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 3\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apicurio_registry:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 3\", \"packageName\": \"bcprov-lts8on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 3\", \"packageName\": \"bcprov-ext-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 3\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 3\", \"packageName\": \"bcprov-lts8on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Keycloak\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8\", \"packageName\": \"bcprov-jdk15\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8\", \"packageName\": \"bcprov-jdk15to18\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"pki-core:10.6/resteasy\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"pki-deps:10.6/resteasy\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"jmc\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"resteasy\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-debug-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-ext-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-ext-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-jdk15\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-jdk15to18\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-jdk16\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"bcprov-jdk12\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"bcprov-jdk15\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-ext-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-ext-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-jdk12\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-jdk15\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-jdk15to18\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"bcprov-jdk18on-1.83.0.redhat-00001.jar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-modelmesh-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"bcprov-jdk15to18\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"candlepin\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite:el8/candlepin\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_single_sign_on:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Single Sign-On 7\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:2\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 2\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:2\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 2\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"packageName\": \"bcprov-jdk15on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"packageName\": \"bcprov-jdk18on\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-15T10:01:27.769Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-15T08:56:34.057Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18054: Red Hat JBoss EAP 8.1 for RHEL 8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18055: Red Hat JBoss EAP 8.1 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60247: OpenShift Developer Tools and Services 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60249: OpenShift Developer Tools and Services 4.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60248: OpenShift Developer Tools and Services 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60239: OpenShift Developer Tools and Services 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60251: OpenShift Developer Tools and Services 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60246: OpenShift Developer Tools and Services 4.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60250: OpenShift Developer Tools and Services 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60252: OpenShift Developer Tools and Services 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60259: OpenShift Developer Tools and Services 4.20\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60254: OpenShift Developer Tools and Services 4.21\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:60256: OpenShift Developer Tools and Services 4.22\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14276: Red Hat AMQ Broker 7.12.7\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14272: Red Hat AMQ Broker 7.13.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13631: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18059: Red Hat JBoss Enterprise Application Platform 8.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24977: Red Hat OpenShift AI 2.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21772: Red Hat OpenShift Dev Spaces 3.28\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17668: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11720: Red Hat build of Quarkus 3.20.6.SP1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11721: Red Hat build of Quarkus 3.27.3.SP1\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-04-15T08:56:34.057Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2025-14813\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2458640\", \"name\": \"RHBZ#2458640\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14813.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53644\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18054\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18055\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60247\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60249\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60248\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60239\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60251\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60246\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60250\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60252\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60259\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60254\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:60256\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14276\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14272\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13631\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53806\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18059\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24977\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21772\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17668\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11720\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11721\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-327\", \"description\": \"Use of a Broken or Risky Cryptographic Algorithm\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-09-04T12:04:50.964Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-14813\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-15T13:19:43.094033Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-15T13:19:45.930Z\"}}], \"cna\": {\"title\": \"GOSTCTR implementation unable to process more than 255 blocks correctly\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"XlabAI Team of Tencent Xuanwu Lab\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Atuin Automated Vulnerability Discovery Engine\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Lili Tang, Guannan Wang, and Guancheng Li\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 9.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"LOCAL\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"RED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"MODERATE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/bcgit/bc-java\", \"vendor\": \"Legion of the Bouncy Castle Inc.\", \"modules\": [\"core\"], \"product\": \"BC-JAVA\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.59\", \"lessThan\": \"1.80.2\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"1.81\", \"lessThan\": \"1.81.1\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"1.82\", \"lessThan\": \"1.84\", \"versionType\": \"maven\"}], \"platforms\": [\"all\"], \"packageName\": \"bcprov\", \"programFiles\": [\"G3413CTRBlockCipher\"], \"collectionURL\": \"https://www.bouncycastle.org/download/bouncy-castle-java/\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/bcgit/bc-java/commit/b42574345414e4b7c8051b16fa1fafe01c29871f\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/bcgit/bc-java/commit/701686cb0184cd9ae103c801b3581fdf95c6d4f3\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \": Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).\\n\\n This vulnerability is associated with program files G3413CTRBlockCipher.\\n\\n\\n\\nThis issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \": Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).\u003cp\u003e This vulnerability is associated with program files G3413CTRBlockCipher.\u003c/p\u003e\u003cp\u003eThis issue affects BC-JAVA: from 1.59 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-327\", \"description\": \"CWE-327: Use of a Broken or Risky Cryptographic Algorithm\"}]}], \"providerMetadata\": {\"orgId\": \"91579145-5d7b-4cc5-b925-a0262ff19630\", \"shortName\": \"bcorg\", \"dateUpdated\": \"2026-05-18T23:15:49.105Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-14813\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-04T12:04:50.964Z\", \"dateReserved\": \"2025-12-17T00:17:44.229Z\", \"assignerOrgId\": \"91579145-5d7b-4cc5-b925-a0262ff19630\", \"datePublished\": \"2026-04-15T08:56:34.057Z\", \"assignerShortName\": \"bcorg\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:60248
Vulnerability from csaf_redhat - Published: 2026-08-26 10:46 - Updated: 2026-09-06 22:24Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60248",
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60248.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.",
"tracking": {
"current_release_date": "2026-09-06T22:24:29+00:00",
"generator": {
"date": "2026-09-06T22:24:29+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:60248",
"initial_release_date": "2026-08-26T10:46:16+00:00",
"revision_history": [
{
"date": "2026-08-26T10:46:16+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-06T22:24:29+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.14",
"product": {
"name": "OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.14::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533561"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3Ae6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533561"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533561"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628748"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3Adf06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786533561"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64 as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64 as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64 as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64 as a component of OpenShift Developer Tools and Services 4.14",
"product_id": "OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.14"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:46:16+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60248"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:4e004c237c3a1d7ccea3cfdd7f73719e46ad9d61a4aa9a80c62334b4079fb716_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:6d7170058331d174f44b7cb7357d3a3983d521e3d8e7cf72db96517b846c40c4_arm64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:8c7d22928f2b2826dc175b512fd3729235f4e04856124be04992f61294445e76_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:9a4306c79b02caa28e3ebde184e1bfefcc42e4ce770f2f710af47f1085721cd8_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:1a2dc4181e1d7843b562548bc136407baa4ddb00b0722d3bf0b9a680e0bf49a5_ppc64le",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8e233835f50fa220f239f725680ed652db47107ce05850c6c42ea85c24795e98_amd64",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:df06db520f7e03e268af43ce242923a48890ebe25926b3d3995babe722cdaf20_s390x",
"OpenShift Developer Tools and Services 4.14:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:e6948192af84f65c1bb3e90b80e24f7b29e2857bbeaee6255eb8328abf2d8366_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60249
Vulnerability from csaf_redhat - Published: 2026-08-26 10:48 - Updated: 2026-09-06 22:23Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60249",
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60249.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.",
"tracking": {
"current_release_date": "2026-09-06T22:23:35+00:00",
"generator": {
"date": "2026-09-06T22:23:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:60249",
"initial_release_date": "2026-08-26T10:48:04+00:00",
"revision_history": [
{
"date": "2026-08-26T10:48:04+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-06T22:23:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.13",
"product": {
"name": "OpenShift Developer Tools and Services 4.13",
"product_id": "OpenShift Developer Tools and Services 4.13",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.13::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8\u0026tag=1786628711"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8\u0026tag=1786628681"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64 as a component of OpenShift Developer Tools and Services 4.13",
"product_id": "OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.13"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64 as a component of OpenShift Developer Tools and Services 4.13",
"product_id": "OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.13"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:48:04+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is not available in rhel8 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60249"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3b8ec6f7ec4523427907b7a7bc95daa742460c3995bba6de284ce47079cf51ae_amd64",
"OpenShift Developer Tools and Services 4.13:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:9335d056f63325a5e27878cdff6cca5124b316d6f1a5bc997f9116eac37c608e_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60250
Vulnerability from csaf_redhat - Published: 2026-08-26 10:51 - Updated: 2026-09-06 22:23Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60250",
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60250.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.",
"tracking": {
"current_release_date": "2026-09-06T22:23:35+00:00",
"generator": {
"date": "2026-09-06T22:23:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:60250",
"initial_release_date": "2026-08-26T10:51:30+00:00",
"revision_history": [
{
"date": "2026-08-26T10:51:30+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-06T22:23:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.18",
"product": {
"name": "OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.18::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Ab92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124633"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125069"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Ad455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124633"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125069"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124633"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Ad31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125069"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Aff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124633"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125069"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64 as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64 as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64 as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64 as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le as a component of OpenShift Developer Tools and Services 4.18",
"product_id": "OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.18"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60250"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:919a06b1160c85e44e2849ee50ed0576747821460895b9f865c9eda7129ccd14_ppc64le",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:b92758f0c3bfc1affbed9250d2224fd177b73d7860e4a4552cfbe9849c786a81_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d455d962d6a5735999d2b38c4d5cd178ca62da7d0cb337162990c5c092724d8c_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:ff3b99e18e5371592f54fbfadf04cac8de3a9355a0eb5c759c53c67fbf972033_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18f4d6ea1e04bdb63a3fddb7658dc125977ac82671ca46bfbd6c3d3c34bb25a5_amd64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:468400f50a67fa6d0c4228377ca7e558e598d981230e96535914751ff5a78a40_s390x",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8cd34b71c985aa26ec4dcde523a42d536cbcf3edb7b43757a50d5d7110423a48_arm64",
"OpenShift Developer Tools and Services 4.18:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d31294d03ca7f688563c7e3840d0aeabbd66779c67861e05fa5b114d945f9266_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60251
Vulnerability from csaf_redhat - Published: 2026-08-26 10:51 - Updated: 2026-09-06 22:23Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60251",
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60251.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.",
"tracking": {
"current_release_date": "2026-09-06T22:23:35+00:00",
"generator": {
"date": "2026-09-06T22:23:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:60251",
"initial_release_date": "2026-08-26T10:51:34+00:00",
"revision_history": [
{
"date": "2026-08-26T10:51:34+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-06T22:23:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.16",
"product": {
"name": "OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.16::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Acb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124634"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125166"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Afecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124634"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125166"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124634"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Ac23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125166"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124634"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125166"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64 as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64 as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64 as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64 as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le as a component of OpenShift Developer Tools and Services 4.16",
"product_id": "OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.16"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:34+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60251"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1d4b400e5097f31e6ccabb68bc1fdc8acf5a583b63c638e21a603b7e8acc5c47_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:804f625349f4ac1250e04d806b44883a8beac175fb0ddfd042a5ac8c222c276f_ppc64le",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:cb89d8060e5ae3e623c6dcbd27a2b9454df637e91f1dd537720174a33eb119f8_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:fecfacdbd7d2344ac7697016edd2d76c191ee35e4bc14d306ad2b132d2e7d8dc_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:0a038ab72bea1f2570f20b4c3a91fdf02a45592bdd9f8262172813cca34033d6_amd64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:70727b31d43ee373a1cffb12bdbcb47c2f5fe03d174ff0016a4ef44e176064bf_s390x",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:83699a96de9627cb0164bf9ae31d3d3537c93b41a72c2ce3bf1ff96a56d3f341_arm64",
"OpenShift Developer Tools and Services 4.16:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:c23664a89feb1e9389947c5baed48fe1012cd36b8e39ca88716d2dad62195788_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60252
Vulnerability from csaf_redhat - Published: 2026-08-26 10:51 - Updated: 2026-09-06 22:23Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60252",
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60252.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.",
"tracking": {
"current_release_date": "2026-09-06T22:23:36+00:00",
"generator": {
"date": "2026-09-06T22:23:36+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:60252",
"initial_release_date": "2026-08-26T10:51:37+00:00",
"revision_history": [
{
"date": "2026-08-26T10:51:37+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-06T22:23:36+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.19",
"product": {
"name": "OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.19::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124663"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124632"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Aa0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124663"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124632"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124663"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Ab952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124632"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787124663"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124632"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64 as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64 as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64 as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64 as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le as a component of OpenShift Developer Tools and Services 4.19",
"product_id": "OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.19"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:37+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60252"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:1477acd00f722cb0d1ed6ee8f07985925a44587fc50acd98e14b8c21ee4e6114_ppc64le",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:50847a66184490e17b3d47f70862bd674103aebfc782515958164a364c899823_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5e9f7b1c88e63987515064812b722d669b637eeb97391b52d2bd56ce0ac68c85_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:a0956de91f8c036ea551e27c15af3cdd0bfe6f61abf6240d1a7abdd62a2d0582_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:3da67486715b68d3dfa5e3b53d2ce06153dcc66004aabb777abfa3ab21c8aac0_amd64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8fee81e34809617638119659d92a5969ee90b520ba5b864d8bd87cc4b94c01ce_arm64",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:91ee296f91f6405799e6978b9322eb51ee7ad61d79b29aa20aeba121044bd3b4_s390x",
"OpenShift Developer Tools and Services 4.19:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b952b6abb5c988d789c8894523156e5b5c38d5ee63b287b08b0713ffe49b1835_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60254
Vulnerability from csaf_redhat - Published: 2026-08-26 10:51 - Updated: 2026-09-06 22:23Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60254",
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60254.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.",
"tracking": {
"current_release_date": "2026-09-06T22:23:39+00:00",
"generator": {
"date": "2026-09-06T22:23:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:60254",
"initial_release_date": "2026-08-26T10:51:44+00:00",
"revision_history": [
{
"date": "2026-08-26T10:51:44+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-06T22:23:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.21",
"product": {
"name": "OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.21::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125679"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Aa01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125311"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3Ad65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125679"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125311"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125679"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Aeb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125311"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125679"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787125311"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64 as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64 as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64 as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64 as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le as a component of OpenShift Developer Tools and Services 4.21",
"product_id": "OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.21"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:51:44+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60254"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:0386f77866ba8bea4b2fc1dda9a11ce0584539c10f983a9d21005a73dad7413b_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:306dc858d0e3bc082afb9b526b3a3b532e9bb0b1c5865a7957edfb060e87c132_ppc64le",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:5a8dcae78f58008903e228d54628368b43c097ea7698baba6289cae63b3ab568_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:d65aeeaac7bf62b294558eff2d8dfbf143aa1d1ae74f895485b2f3961bc3a6eb_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:18a0a6ff86aa74b7319fe71cbe221b0868cf2964f8faa31cb00c01544db6195d_s390x",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:318ff68c15583bd4cfa8f4ea3b9254160f3b0a0b1308a6cb93f39241bee605f9_arm64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:a01210c1f2794b2a85fb434b3e9f054b06504c7b36eb1e6fb7665c1a6b2dc7c9_amd64",
"OpenShift Developer Tools and Services 4.21:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:eb64943a855ef3071a795d7e1b67759aa51a8f05ab5c44bf575cfb670a70b125_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60256
Vulnerability from csaf_redhat - Published: 2026-08-26 10:52 - Updated: 2026-09-06 22:23Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60256",
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60256.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.",
"tracking": {
"current_release_date": "2026-09-06T22:23:36+00:00",
"generator": {
"date": "2026-09-06T22:23:36+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:60256",
"initial_release_date": "2026-08-26T10:52:02+00:00",
"revision_history": [
{
"date": "2026-08-26T10:52:02+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-06T22:23:36+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.22",
"product": {
"name": "OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.22::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125563"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124779"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125563"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Ad62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124779"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125563"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Aadac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124779"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125563"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124779"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64 as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64 as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64 as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64 as a component of OpenShift Developer Tools and Services 4.22",
"product_id": "OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.22"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:52:02+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60256"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:15c4b6e267a30b181b909106fb8b80de7f6c6a1b234dc4589b82a66fd5190bae_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:3c558027583ae06bcf6044a086ffdf9eba15c8dd2469efd2fc8c6287888f8659_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:43515966cc3d08789e580d7e1a30388895fc56c2831e8cac7350d2c4799c97e6_arm64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:44da2c30db909bb2bfae3096e871250426614981b1305fbb26ec77611048b4a0_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:6c5b65b54d8f92d0d82cb23710764f01c4a2e25109a598dbe8626166483b7879_s390x",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:84ca341a05724c1fea917b30b824a4490ea6696e497856732edfc2366d217502_amd64",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:adac4e991958fc25049b8c092cea31963310d377d61f1f1d80aec22ad1161251_ppc64le",
"OpenShift Developer Tools and Services 4.22:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:d62461c8ae692ac0c36fa3c02171bc9166ae2cd1731fc01dbc65383d2f9277d3_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
RHSA-2026:60259
Vulnerability from csaf_redhat - Published: 2026-08-26 10:57 - Updated: 2026-09-06 22:23Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
Severity
Important
Notes
Topic: An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20.
Details: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Important
A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Low
A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Low
A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.
9.8 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Low
A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size limit is applied. This can lead to the affected system becoming unresponsive.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin's failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.
8.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — | ||
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Threats
Impact
Important
A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.
8.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller's file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system's availability.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.
6.8 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
196 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:60259",
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-29371",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14813",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67030",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0636",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1605",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2332",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3505",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40542",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41409",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41635",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42778",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42779",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47065",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50193",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53435",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53437",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54399",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54428",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54512",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5588",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56624",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57280",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57281",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-64607",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-68494",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70426",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70427",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70428",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-70429",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/jenkins",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/jenkins"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60259.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.",
"tracking": {
"current_release_date": "2026-09-06T22:23:38+00:00",
"generator": {
"date": "2026-09-06T22:23:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:60259",
"initial_release_date": "2026-08-26T10:57:33+00:00",
"revision_history": [
{
"date": "2026-08-26T10:57:33+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-02T15:59:51+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-06T22:23:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.20",
"product": {
"name": "OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.20::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125493"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124925"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125493"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124925"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125493"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3A33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124925"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel9@sha256%3A23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9\u0026tag=1787125493"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel9@sha256%3Ab89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9\u0026tag=1787124925"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64 as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64 as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64 as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64 as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x as a component of OpenShift Developer Tools and Services 4.20",
"product_id": "OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.20"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-29371",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2025-12-17T16:01:18.173727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423194"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jose4j. A remote attacker can exploit this by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression. This can lead to a Denial of Service, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important as it can lead to a Denial of Service in applications that process untrusted JSON Web Encryption tokens. An attacker can craft a malicious JWE token with an exceptionally high compression ratio, causing excessive memory allocation and processing time during decompression in affected components like jose4j. This affects products such as Red Hat AMQ, Enterprise Application Platform (EAP 8.0.z, 8.1.z), Red Hat JBoss Fuse, JBoss Data Grid, OpenShift Developer Tools \u0026 Services, Red Hat build of Apache Camel, Red Hat Integration, Red Hat OpenShift Dev Spaces, Red Hat Process Automation Manager, Red Hat Single Sign-On (RH-SSO), Insights, cloud.redhat.com, and OpenShift Serverless.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-29371"
},
{
"category": "external",
"summary": "RHBZ#2423194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29371"
},
{
"category": "external",
"summary": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack",
"url": "https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack"
}
],
"release_date": "2025-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2026-04-15T10:01:27.769752+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458640"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.\nThe primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "RHBZ#2458640",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458640"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14813"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813"
}
],
"release_date": "2026-04-15T08:56:34.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly"
},
{
"cve": "CVE-2025-67030",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-25T18:02:00.463244+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"category": "external",
"summary": "RHBZ#2451409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67030",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"category": "external",
"summary": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec",
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642",
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/issues/294",
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/295",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"category": "external",
"summary": "https://github.com/codehaus-plexus/plexus-utils/pull/296",
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
}
],
"release_date": "2026-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method"
},
{
"cve": "CVE-2026-0636",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
},
"discovery_date": "2026-04-15T10:01:32.911938+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458641"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit crafted input to an application using the `LDAPStoreHelper` implementation for directory queries. An attack typically requires the application to pass the malicious input directly into a search filter, allowing the attacker to modify the resulting LDAP query.\nThe primary impact of this vulnerability is the loss of confidentiality and integrity for directory data. This can allow an attacker to bypass search restrictions and manipulate directory results, potentially leading to unauthorized access or privilege escalation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "RHBZ#2458641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"release_date": "2026-04-15T08:59:12.677000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java"
},
{
"cve": "CVE-2026-1605",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-03-05T11:00:57.250283+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2444815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server\u0027s response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustion can result in a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Eclipse Jetty\u0027s GzipHandler can lead to a denial of service in affected Red Hat products. The vulnerability arises when compressed HTTP requests are processed without a corresponding compressed response, causing a resource leak that can exhaust system resources and render the service unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1605"
},
{
"category": "external",
"summary": "RHBZ#2444815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"
}
],
"release_date": "2026-03-05T09:39:01.315000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-14T12:01:05.768902+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458187"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a crafted payload to a Jetty server that is behind a reverse proxy or load balancer, specifically with a chunk extension that includes an unclosed double quote before the CRLF to trick the parser. This flaw allows an attacker to bypass security controls, cause cache poisoning or gain unauthorized endpoint access. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2332"
},
{
"category": "external",
"summary": "RHBZ#2458187",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458187"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"category": "external",
"summary": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf",
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89"
}
],
"release_date": "2026-04-14T10:59:10.193000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-15T10:01:17.415497+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458638"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.\nThe primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "RHBZ#2458638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458638"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3505"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3505"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505"
}
],
"release_date": "2026-04-15T09:06:37.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion"
},
{
"cve": "CVE-2026-5588",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-04-15T10:00:59.672015+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458634"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.\nThe primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "RHBZ#2458634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458634"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588"
}
],
"release_date": "2026-04-15T09:06:15.617000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid"
},
{
"cve": "CVE-2026-40542",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-04-22T08:00:57.407831+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460518"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpClient. This vulnerability allows a remote attacker to bypass a critical step in the SCRAM-SHA-256 authentication process. By exploiting this, an attacker can trick the client into accepting authentication without proper mutual verification, potentially compromising the confidentiality and integrity of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40542"
},
{
"category": "external",
"summary": "RHBZ#2460518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40542"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40542"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97",
"url": "https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"
}
],
"release_date": "2026-04-22T07:07:21.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification"
},
{
"cve": "CVE-2026-41409",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:21.857504+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization vulnerability in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This could enable a remote attacker to execute arbitrary code by sending specially crafted data to an application using Apache MINA that calls `IoBuffer.getObject()`.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41409"
},
{
"category": "external",
"summary": "RHBZ#2463175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41409"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9",
"url": "https://lists.apache.org/thread/9ddvsq6c4l5bhwq8l14sob4f8qjvx5c9"
}
],
"release_date": "2026-04-27T09:20:12.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix"
},
{
"cve": "CVE-2026-41635",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-04-27T10:01:29.162466+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. A remote attacker could exploit a vulnerability in the `AbstractIoBuffer.resolveClass()` method, which failed to properly validate class names for static classes or primitive types. This bypasses the intended security control, known as a classname allowlist, allowing an attacker to execute arbitrary code on systems running applications that use Apache MINA and call `IoBuffer.getObject()`. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41635"
},
{
"category": "external",
"summary": "RHBZ#2463177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41635"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm",
"url": "https://lists.apache.org/thread/1l91w1mqsb3lwfd504fs045ylxntt2tm"
}
],
"release_date": "2026-04-27T08:59:50.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass"
},
{
"cve": "CVE-2026-42778",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:54.113894+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An incomplete fix for a deserialization issue in the `AbstractIoBuffer.getObject()` method allowed a static initializer in a class to be executed before the classname allowlist was applied. This vulnerability allows a remote attacker to execute arbitrary code in applications calling the `IoBuffer.getObject()` method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42778"
},
{
"category": "external",
"summary": "RHBZ#2464321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42778"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:01:10.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409)"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-01T11:00:57.394429+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA. An attacker can exploit a vulnerability in the AbstractIoBuffer.resolveClass() method, specifically when IoBuffer.getObject() is called, to bypass the classname allowlist. This bypass allows for the execution of arbitrary code, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42779"
},
{
"category": "external",
"summary": "RHBZ#2464322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42779"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0",
"url": "https://lists.apache.org/thread/fhlx5k91hrkgyzh7yk1nghrn3k27gxy0"
}
],
"release_date": "2026-05-01T10:00:43.712000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass"
},
{
"cve": "CVE-2026-47065",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-03T11:00:54.906615+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mina. This vulnerability involves two issues related to how the software handles serialized objects, which are objects converted into a format for storage or transmission. Firstly, a bypass in the `resolveProxyClass` method allows for the deserialization of `java.lang.reflect.Proxy` objects, which are special objects used to control access to other objects. This bypass can circumvent security filters designed to prevent malicious object deserialization. Secondly, deserializing a stream that names an allow-listed class can trigger its static initializer, a block of code that runs automatically when a class is loaded. A remote attacker could exploit these flaws to execute arbitrary code, gaining unauthorized control over the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mina: mina: Arbitrary Code Execution via Deserialization Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products are affected by this vulnerability. However, the vulnerable code cannot be reached and therefore are not vulnerable. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47065"
},
{
"category": "external",
"summary": "RHBZ#2484326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47065"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj",
"url": "https://lists.apache.org/thread/y7xj1bl8qo47p9bktb11hg5v6k1d4dyj"
}
],
"release_date": "2026-06-03T09:39:41.629000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "mina: mina: Arbitrary Code Execution via Deserialization Bypass"
},
{
"cve": "CVE-2026-50193",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-23T22:01:01.154533+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491999"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50193"
},
{
"category": "external",
"summary": "RHBZ#2491999",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491999"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50193"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c",
"url": "https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/3447",
"url": "https://github.com/FasterXML/jackson-databind/issues/3447"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh"
}
],
"release_date": "2026-06-23T21:00:20.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing"
},
{
"cve": "CVE-2026-53435",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-10T14:01:29.010936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers can exploit a deserialization vulnerability by submitting a specially crafted `config.xml` file. This allows them to deserialize arbitrary types, leading to the ability to impersonate users and send HTTP requests on their behalf. The most critical impact is the potential for arbitrary code execution through the Script Console, as well as unauthorized reading of files from the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53435"
},
{
"category": "external",
"summary": "RHBZ#2487539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53435"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707"
}
],
"release_date": "2026-06-10T13:05:57.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration"
},
{
"cve": "CVE-2026-53437",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-06-10T14:01:45.853979+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. This vulnerability allows a remote attacker to perform phishing attacks by crafting a malicious redirect URL. The flaw occurs because Jenkins improperly validates redirect URLs after login, specifically when tab or newline characters are present between the `//` in the URL. This can trick users into visiting malicious sites, potentially leading to credential theft or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Phishing attack via improper redirect URL validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Jenkins that allows remote attackers to conduct phishing attacks. The flaw stems from improper validation of redirect URLs after login, specifically when tab or newline characters are present, which can be exploited to redirect users to malicious sites. This could lead to credential theft and other security compromises for users interacting with affected Jenkins instances in Red Hat OpenShift Developer Tools \u0026 Services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53437"
},
{
"category": "external",
"summary": "RHBZ#2487544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53437"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53437"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755",
"url": "https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3711+3755"
}
],
"release_date": "2026-06-10T13:05:58.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Phishing attack via improper redirect URL validation"
},
{
"cve": "CVE-2026-54399",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:08.214968+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496101"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54399"
},
{
"category": "external",
"summary": "RHBZ#2496101",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
"url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
}
],
"release_date": "2026-07-01T17:02:21.778000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
},
{
"cve": "CVE-2026-54428",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-01T18:02:25.195687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496106"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54428"
},
{
"category": "external",
"summary": "RHBZ#2496106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
"url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
"url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
}
],
"release_date": "2026-07-01T17:03:53.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-23T22:01:49.821346+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54512"
},
{
"category": "external",
"summary": "RHBZ#2492015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5",
"url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/5988",
"url": "https://github.com/FasterXML/jackson-databind/issues/5988"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm"
}
],
"release_date": "2026-06-23T20:56:36.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass"
},
{
"cve": "CVE-2026-56624",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-07-20T21:01:48.146372+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD (server-side). During user authentication, the server\u0027s OpenSSH user certificate validation process failed to properly check for or validate unsupported options like \u0027force-command\u0027 or \u0027verify-required\u0027 embedded within a user\u0027s certificate. This oversight could allow an authenticated user to bypass intended restrictions and execute commands beyond those specified in their certificate, potentially leading to unauthorized actions on the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56624"
},
{
"category": "external",
"summary": "RHBZ#2503053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56624"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6",
"url": "https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6"
}
],
"release_date": "2026-07-20T20:28:26.333000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation"
},
{
"cve": "CVE-2026-57280",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-06-24T14:02:10.297065+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492199"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Script Security Plugin. This vulnerability allows attackers who can provide sandboxed Groovy scripts to bypass security sandbox protections. By exploiting a failure to properly intercept implicit type casts in typed for-each loops, an attacker can invoke arbitrary constructors, potentially leading to arbitrary code execution within the Jenkins environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as an Important vulnerability in the Jenkins Script Security Plugin. Attackers with the ability to provide sandboxed Groovy scripts can bypass sandbox protections due to improper handling of implicit type casts in typed for-each loops, allowing arbitrary constructor invocation and potential code execution within the Jenkins JVM. The scope is unchanged (S:U) because the sandbox and the Jenkins controller share the same security authority \u2014 a sandbox escape executes code in the same context rather than crossing a trust boundary to a separate system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57280"
},
{
"category": "external",
"summary": "RHBZ#2492199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57280"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3792"
}
],
"release_date": "2026-06-24T13:20:04.064000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Sandbox bypass leading to arbitrary code execution"
},
{
"cve": "CVE-2026-57281",
"cwe": {
"id": "CWE-917",
"name": "Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)"
},
"discovery_date": "2026-06-24T14:02:12.873680+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492200"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jenkins Script Security Plugin. Attackers with the ability to run sandboxed Groovy scripts can exploit this vulnerability to execute arbitrary code outside the sandbox environment. This is due to the plugin\u0027s failure to reject Groovy Abstract Syntax Tree (AST) transformation annotations that include an extensions member, allowing unauthorized script execution if a suitable script exists on the classpath.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact as the Jenkins Script Security Plugin shipped in Red Hat OpenShift Container Platform is susceptible to a sandbox bypass. An authenticated attacker with the ability to run sandboxed Groovy scripts can exploit improperly handled AST transformation annotations to execute arbitrary code outside the sandbox on the Jenkins controller. Exploitation requires a suitable script to be present on the classpath, increasing attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57281"
},
{
"category": "external",
"summary": "RHBZ#2492200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57281"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3793"
}
],
"release_date": "2026-06-24T13:20:04.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins-script-security-plugin: Jenkins Script Security Plugin: Arbitrary code execution outside sandbox"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-70426",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-08-05T18:02:33.980843+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins Remoting. This vulnerability allows agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter. This bypass occurs because the filter is not applied to classes resolved through a fallback path in the Remoting deserialization implementation. Successful exploitation could lead to arbitrary code execution on the Jenkins controller.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools \u0026 Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure.\n\nAgent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster\u0027s internal pod network which reduces the attack vector from Network to Adjacent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70426"
},
{
"category": "external",
"summary": "RHBZ#2511685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70426"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70426"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3911"
}
],
"release_date": "2026-08-05T17:40:27.071000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remoting: Jenkins Remoting: Arbitrary code execution via deserialization filter bypass"
},
{
"cve": "CVE-2026-70427",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-05T18:02:07.592589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows attackers who can control a Jenkins agent process to exploit unsafe handling of symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, writing files to arbitrary locations on the Jenkins controller\u0027s file system. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70427"
},
{
"category": "external",
"summary": "RHBZ#2511678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70427"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3930"
}
],
"release_date": "2026-08-05T17:40:27.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Until Jenkins is updated to a fixed version, restrict which users and systems are permitted to connect build agents to the Jenkins controller, and avoid running untrusted or externally triggered build jobs on agents that can return archives to the controller. Monitor the Jenkins controller\u0027s file system, in particular the init.groovy.d and plugins directories under the Jenkins home directory, for unauthorized changes.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via crafted archives and symbolic links"
},
{
"cve": "CVE-2026-70428",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-05T18:01:07.048868+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Attackers with specific permissions (Item/Configure and Item/Build) can exploit this vulnerability. By manipulating file parameter names, they can bypass security checks and write files to any location on the Jenkins controller\u0027s file system. This path traversal vulnerability could lead to unauthorized code execution or disrupt the system\u0027s availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Arbitrary file write via path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Jenkins allows authenticated attackers with Item/Configure and Item/Build permissions to perform path traversal via file parameter names, leading to arbitrary file writes on the controller file system. This could result in arbitrary code execution and compromise of the Jenkins instance, but requires existing elevated privileges within the application, limiting the attack surface to trusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70428"
},
{
"category": "external",
"summary": "RHBZ#2511664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70428"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70428"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3927"
}
],
"release_date": "2026-08-05T17:40:28.349000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the `Item/Configure` and `Item/Build` permissions within Jenkins to only highly trusted users. This limits the pool of potential attackers who could exploit the path traversal vulnerability. Additionally, implement robust monitoring of the Jenkins controller\u0027s file system for any unauthorized write operations, which could indicate an attempted exploitation.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: Jenkins: Arbitrary file write via path traversal"
},
{
"cve": "CVE-2026-70429",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-08-05T18:02:56.692364+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could impersonate other users or gain unauthorized permissions, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenShift Jenkins (ocp-tools-4) ships Jenkins core versions well below the fixed 2.568.2 LTS release and is affected. Exploitation requires an attacker who already has the ability to create new users or groups in the configured security realm, which supports Privileges Required: Low rather than None. This is consistent with how Red Hat resolved the sibling flaws from the same 2026-08-05 Jenkins security advisory, CVE-2026-70428 (arbitrary file write) and CVE-2026-70426 (remoting deserialization bypass), both of which affect the same ocp-tools-4/jenkins component and were resolved AFFECTED/DELEGATED with trackers filed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70429"
},
{
"category": "external",
"summary": "RHBZ#2511690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70429"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924",
"url": "https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3924"
}
],
"release_date": "2026-08-05T17:40:29.055000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-26T10:57:33+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20 upgrade to the latest. This image uses java-21-openjdk as the default JDK. java-25-openjdk is available in rhel9 images. java-17-openjdk is removed.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:60259"
},
{
"category": "workaround",
"details": "Restrict the ability to create new users or groups to trusted administrators; disable self-registration and public account/group creation in the configured security realm. If the realm permits non-ASCII characters in user or group names, enforce ASCII-only naming policies at the identity provider to remove the attack surface. Upgrading to Jenkins weekly 2.576 or LTS 2.568.2 fully resolves the issue.",
"product_ids": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:23368a8f8e04bc2ce3dc46317a4ef4580081165ef00a6916688ae489983e66ab_s390x",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:325087ceeaf4861b3118181f1745771c92e8828797621c804197d6f0167e0e91_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:7080500c199cec5ab404d643ad4c379e08cf11b4bbad959c8a5b8ce35ff5e78f_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel9@sha256:8bc35fe48f2e28271f6af6b9b1a22a5f53e322fb8360fbfabf8f1259d35e0cd8_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:33284e3e3e41e780016da544d7a6324c6d7f316ffb86142fa62a0db2bd78af58_ppc64le",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:75f60dc27c6dc7b1893b701c50f5d90e78eaf429fb464d800ab893a232e956da_amd64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:8efc65dc6bb19045cc801f6f07f4e2801f710ba105e5d36d7e88bc5d251a3a14_arm64",
"OpenShift Developer Tools and Services 4.20:registry.redhat.io/ocp-tools-4/jenkins-rhel9@sha256:b89b59be7aadc4b8ea009199ece674648d80c0a5254c5b6a852acd6cc92d45cf_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jenkins: Jenkins: Privilege escalation via inconsistent case sensitivity in user and group names"
}
]
}
SUSE-SU-2026:1639-1
Vulnerability from csaf_suse - Published: 2026-04-28 11:10 - Updated: 2026-04-28 11:10Summary
Security update for bouncycastle
Severity
Important
Notes
Title of the patch: Security update for bouncycastle
Description of the patch: This update for bouncycastle fixes the following issues:
Update to version 1.84.
Security issues fixed:
- CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly (bsc#1262225).
- CVE-2026-0636: LDAP injection in LDAPStoreHelper.java leads to information disclosure (bsc#1262226).
- CVE-2026-3505: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (bsc#1262232).
- CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature sequence as valid (bsc#1262228).
- CVE-2026-5598: non-constant time comparisons risks private key leakage in FrodoKEM (bsc#1262227).
Other updates and bugfixes:
- Version 1.84:
- In line with JVM changes, KEM support has been backported to
Java 17.
- BCJSSE: Configurable (client) early key_share groups via
BCSSLParameters.earlyKeyShares or
'org.bouncycastle.jsse.client.earlyKeyShares' system property.
- BCJSSE: Support for curveSM2MLKEM768 hybrid NamedGroup in TLS
1.3 per draft-yang-tls-hybrid-sm2-mlkem-03.
- BCJSSE: Log when default cipher suites are disabled.
- BCJSSE: Experimental support for ShangMi crypto in TLS 1.3 per
RFC 8998 (not enabled by default).
- CMS: Added CMSAuthEnvelopedDataStreamGenerator.open taking an
explicit content type.
- HKDF: Provider support for HKDFParameterSpec.Expand.
- Added initial support for RFC 9380 (Hashing to Elliptic Curves);
see org.bouncycastle.crypto.hash2curve .
- PKCS12: Added default max iteration count of 5,000,000 (configurable
via 'org.bouncycastle.pkcs12.max_it_count' property).
- TLS: Use javax.crypto.KEM API (when available) to access ML-KEM
implementation (incl. hybrids).
- A new KeyStore, PKCS12-PBMAC1, has been added which defaults to
using PBMAC1 and supports RFC 9879.
- A new property 'org.bouncycastle.asn1.max_cons_depth' has been added
to allow setting of the maximum nesting for SETs/SEQUENCESs in ASN.1.
Default is 32.
- A new property 'org.bouncycastle.asn1.max_limit' has been added
to allow setting of the stream size of ASN.1 encodings. The value can
be either in bytes, or appended with k (1 kilobyte blocks), m (1
megabyte blocks), or g (1 gigabyte blocks).
- Added NTRU+ support to the lightweight PQC API and the BCPQC provider.
- Added SM4 key wrap/unwrap mode, SM2 key exchange, and logging to SM2Signer.
- OpenPGP: Added encryption-key filtering by purpose, a new OpenPGPKey
constructor, KeyPassphraseProvider-based passphrase change, wildcard
(anonymous) recipient handling, and Web-of-Trust methods for
third-party signature chains and delegations.
- CMSSignedDataStreamGenerator can now support the generation of DER/DL
encoded SignedData objects (note memory restrictions still apply).
- It is now possible to add extra digest alorithm IDs to
CMSSignedDataStreamGenerator when required.
- Random numbers being generated for DSTU4145 signature calculations
were 1 bit shorter than they could be. The code has been corrected
to allow the generated numbers to occupy the full numeric range available.
- HKDF implementation has been corrected to use multiple IKMs if available.
- CompositePublic/PrivateKey builders had an issue identifying brainpool
and EdDSA curves from the algorithm names due to an error in the OID
mapping table. This has been fixed.
- S/MIME: Fix AuthEnveloped support for AES192/GCM and AES256/GCM.
- CMS: Use implicit tag for AuthEnvelopedData.authEncryptedContentInfo.encryptedContent.
- Fixed Strings.split to handle delimiters at position 0.
- Fixed FrodoKEM error sampling to be constant-time.
- Fixed PKIXNameConstraintValidator to treat a DNS name as intersecting itself.
- Fixed PKCS12 key stores not calling getInstance with the original provider
(which was forcing provider registration).
- A resource leak due to the SMIMESigned constructor leaving background
threads hanging on MessagingException has been fixed.
- OpenPGP: Fixed an issue where a custom signature creation time was
ignored when generating message signatures.
- OpenPGP: Fixed SKESK encoding for direct-S2K-encrypted messages.
- Version 1.83:
- Attempting to check a password on a stripped PGP would throw an
exception. Checking the password on such a key will now always
return false.
- Fixed an issue in KangarooTwelve where premature absorption caused
erroneous 168-byte padding; absorption is now delayed so correct
final-byte padding is applied.
- BCJSSE: Fix supported_versions creation for renegotiation handshake.
- (D)TLS: Reneg info now oly offered with pre-1.3.
- A generic 'COMPOSITE' algorithm name has been added as a JCA
Signature algorithm. The algorithm will identify the composite
signature to use from the composite key passed in.
- The composite signatures implementation has been updated to the
final draft and now follows the submitted standard.
- Support for the generation and use as trust anchors has been added
for certificate signatures with id-alg-unsigned as the signature type.
- Support for CMP direct POP for encryption keys using
challenge/response has been added to the CMP/CRMF APIs.
- Support for SupportedCurves attribute to the BC provider
- BCJSSE: Added support for SLH-DSA signature schemes in TLS 1.3 per
draft-reddy-tls-slhdsa-01.
- Support has been added for the Java 25 KDF API (current algorithms,
PBKDF2, SCRYPT, and HKDF).
- Support for composite signatures is now included in CMS and timestamping.
- It is now possible to disable the Lenstra check in RSA where the public
key is not available via the system/security property
'org.bouncycastle.rsa.no_lenstra_check'.
- Version 1.82:
- SNOVA and MAYO are now correctly added to the JCA provider module-info file.
- TLS: Avoid nonce reuse error in JCE AEAD workaround for pre-Java7.
- BCJSSE: Session binding map is now shared across all stages of the
session lifecycle (SunJSSE compatibility).
- The CMCEPrivateKeyParameters#reconstructPublicKey method was returning
an empty byte array. It now returns an encoding of the public key.
- CBZip2InputStream no longer auto-closes at end-of-contents.
- The BC CertPath implementation was eliminating certificates on the
bases of the Key-ID. This is not in accordance with RFC 4158.
- Support for the previous set of libOQS Falcon OIDs has been restored.
- The BC CipherInputStream could throw an exception if asked to handle an
AEAD stream consisting of the MAC only.
- Some KeyAgreement classes were missing in the Java 11 class hierarchy.
- Fix typo in a constant name in the HPKE class and deprecate the old constant.
- Fuzzing analysis has been done on the OpenPGP API and additional code
has been added to prevent escaping exceptions.
- SHA3Digest, CSHAKE, TupleHash, KMAC now provide support for Memoable
and EncodableService.
- BCJSSE: Added support for integrity-only cipher suites in TLS 1.3 per RFC 9150.
- BCJSSE: Added support for system properties 'jdk.tls.{client,server}.maxInboundCertificateChainLength'
- BCJSSE: Added support for ML-DSA signature schemes in TLS 1.3 per draft-ietf-tls-mldsa-00.
- The Composite post-quantum signatures implementation has been updated to
the latest draft (07) draft-ietf-lamps-pq-composite-sigs.
- '_PREHASH' implementations are now provided for all composite signatures
to allow the hash of the date to be used instead of the actual data in
signature calculation.
- The gradle build can now be used to generate an Bill of Materials (BOM) file.
- It is now possible to configure the SignerInfoVerifierBuilder used by the
SignedMailValidator class.
- The Ascon family of algorithms has been updated with the latest published changes.
- Composite signature keys can now be constructed from the individual keys of
the algorithms composing the composite.
- PGPSecretKey, PGPSignatureGenerator now support version 6.
- Further optimisation work has been done on ML-KEM public key validation.
- Zeroization of passwords in the JCA PKCS12 key store has been improved.
- The 'org.bouncycastle.drbg.effective_256bits_entropy' property has been
added for platforms where the entropy source is not producing 1 full bit
of entropy per bit and additional bits are required (default value 282).
- OpenPGPKeyGenerator now allows for the use of empty UserIDs (version 4 compatibility).
- The HQC KEM has been updated with the latest draft updates.
- The legacy post-quantum package has now been removed.
- Version 1.81:
- A potention NullPointerException in the KEM KDF KemUtil class
has been removed.
- Overlapping input/output buffers in doFinal could result in
data corruption.
- Fixed Grain-128AEAD decryption incorrectly handle MAC verification.
- Add configurable header validation to prevent malicious header
injection in PGP cleartext signed messages; Fix signature packet
encoding issues in PGPSignature.join() and embedded signatures
while phasing out legacy format.
- Fixed ParallelHash initialization stall when using block size B=0.
- The PRF from the PBKDF2 function was been lost when PBMAC1 was
initialized from protectionAlgorithm. This has been fixed.
- The lowlevel DigestFactory was cloning MD5 when being asked
to clone SHA1.
- XWing implementation updated to draft-connolly-cfrg-xwing-kem/07/
- Further support has been added for generation and use of PGP V6 keys
- Additional validation has been added for armored headers in Cleartext
Signed Messages.
- The PQC signature algorithm proposal Mayo has been added to the
low-level API and the BCPQC provider.
- The PQC signature algorithm proposal Snova has been added to the
low-level API and the BCPQC provider.
- Support for ChaCha20-Poly1305 has been added to the CMS/SMIME APIs.
- The Falcon implementation has been updated to the latest draft.
- Support has been added for generating keys which encode as seed-only
and expanded-key-only for ML-KEM and ML-DSA private keys.
- Private key encoding of ML-DSA and ML-KEM private keys now follows
the latest IETF draft.
- The Ascon family of algorithms has been updated to the initial draft
of SP 800-232. Some additional optimisation work has been done.
- Support for ML-DSA's external-mu calculation and signing has been
added to the BC provider.
- CMS now supports ML-DSA for SignedData generation.
- Introduce high-level OpenPGP API for message creation/consumption
and certificate evaluation.
- Added JDK21 KEM API implementation for HQC algorithm.
- BCJSSE: Strip trailing dot from hostname for SNI, endpointID checks.
- BCJSSE: Draft support for ML-KEM updated (draft-connolly-tls-mlkem-key-agreement-05).
- BCJSSE: Draft support for hybrid ECDHE-MLKEM (draft-ietf-tls-ecdhe-mlkem-00).
- BCJSSE: Optionally prefer TLS 1.3 server's supported_groups order
(BCSSLParameters.useNamedGroupsOrder).
- Version 1.80:
- A splitting issue for ML-KEM led to an incorrect size for kemct
in KEMRecipientInfos. This has been fixed.
- The PKCS12 KeyStore has been adjusted to prevent accidental doubling
of the Oracle trusted certificate attribute (results in an IOException
when used with the JVM PKCS12 implementation).
- The SignerInfoGenerator copy constructor was ignoring the certHolder field.
- The getAlgorithm() method return value for a CompositePrivateKey was
not consistent with the corresponding getAlgorithm() return value for
the CompositePrivateKey. This has been fixed.
- The international property files were missing from the bcjmail distribution.
- Issues with ElephantEngine failing on processing large/multi-block messages
have been addressed.
- GCFB mode now fully resets on a reset.
- The lightweight algorithm contestants: Elephant, ISAP, PhotonBeetle,
Xoodyak now support the use of the AEADParameters class and provide
accurate update/doFinal output lengths.
- An unnecessary downcast in CertPathValidatorUtilities was resulting
in the ignoring of URLs for FTP based CRLs.
- A regression in the OpenPGP API could cause NoSuchAlgorithmException
to be thrown when attempting to use SHA-256 in some contexts.
- EtsiTs1029411TypesAuthorization was missing an extension field.
- Interoperability issues with single depth LMS keys have been addressed.
- CompositeSignatures now updated to draft-ietf-lamps-pq-composite-sigs-03.
- ML-KEM, ML-DSA, SLH-DSA, and Composite private keys now use raw encodings
as per the latest drafts from IETF 121: draft-ietf-lamps-kyber-certificates-06,
draft-ietf-lamps-dilithium-certificates-05, and draft-ietf-lamps-x509-slhdsa.
- Initial support has been added for RFC 9579 PBMAC1 in the PKCS API.
- Support has been added for EC-JPAKE to the lightweight API.
- Support has been added for the direct construction of S/MIME AuthEnvelopedData
objects, via the SMIMEAuthEnvelopedData class.
- An override 'org.bouncycastle.asn1.allow_wrong_oid_enc' property has been
added to disable new OID encoding checks (use with caution).
- Support has been added for the PBEParemeterSpec.getParameterSpec()
method where supported by the JVM.
- ML-DSA/SLH-DSA now return null for Signature.getParameters() if no context
is provided. This allows the algorithms to be used with the existing Java key tool.
- HQC has been updated to reflect the reference implementation released on 2024-10-30.
- Support has been added to the low-level APIs for the OASIS Shamir Secret
Splitting algorithms.
- BCJSSE: System property 'org.bouncycastle.jsse.fips.allowGCMCiphersIn12'
no longer used. FIPS TLS 1.2 GCM suites can now be enabled according to
JcaTlsCrypto#getFipsGCMNonceGeneratorFactory (see JavaDoc for details) if
done in alignment with FIPS requirements.
- Support has been added for OpenPGP V6 PKESK and message encryption.
- PGPSecretKey.copyWithNewPassword() now includes AEAD support.
- The ASCON family of algorithms have been updated in accordance with the
published FIPS SP 800-232 draft.
Patchnames: SUSE-2026-1639,SUSE-SLE-Module-Development-Tools-15-SP7-2026-1639,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1639,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1639,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1639,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1639,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1639,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1639,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1639,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1639,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1639,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1639
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.6 (High)
Affected products
Recommended
44 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
44 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
44 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
44 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
8.6 (High)
Affected products
Recommended
44 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
24 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for bouncycastle",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for bouncycastle fixes the following issues:\n\nUpdate to version 1.84.\n\nSecurity issues fixed:\n\n- CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly (bsc#1262225).\n- CVE-2026-0636: LDAP injection in LDAPStoreHelper.java leads to information disclosure (bsc#1262226).\n- CVE-2026-3505: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (bsc#1262232).\n- CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature sequence as valid (bsc#1262228).\n- CVE-2026-5598: non-constant time comparisons risks private key leakage in FrodoKEM (bsc#1262227).\n\nOther updates and bugfixes:\n\n- Version 1.84:\n - In line with JVM changes, KEM support has been backported to\n Java 17.\n - BCJSSE: Configurable (client) early key_share groups via\n BCSSLParameters.earlyKeyShares or\n \u0027org.bouncycastle.jsse.client.earlyKeyShares\u0027 system property.\n - BCJSSE: Support for curveSM2MLKEM768 hybrid NamedGroup in TLS\n 1.3 per draft-yang-tls-hybrid-sm2-mlkem-03.\n - BCJSSE: Log when default cipher suites are disabled.\n - BCJSSE: Experimental support for ShangMi crypto in TLS 1.3 per\n RFC 8998 (not enabled by default).\n - CMS: Added CMSAuthEnvelopedDataStreamGenerator.open taking an\n explicit content type.\n - HKDF: Provider support for HKDFParameterSpec.Expand.\n - Added initial support for RFC 9380 (Hashing to Elliptic Curves);\n see org.bouncycastle.crypto.hash2curve .\n - PKCS12: Added default max iteration count of 5,000,000 (configurable\n via \u0027org.bouncycastle.pkcs12.max_it_count\u0027 property).\n - TLS: Use javax.crypto.KEM API (when available) to access ML-KEM\n implementation (incl. hybrids).\n - A new KeyStore, PKCS12-PBMAC1, has been added which defaults to\n using PBMAC1 and supports RFC 9879.\n - A new property \u0027org.bouncycastle.asn1.max_cons_depth\u0027 has been added\n to allow setting of the maximum nesting for SETs/SEQUENCESs in ASN.1.\n Default is 32.\n - A new property \u0027org.bouncycastle.asn1.max_limit\u0027 has been added\n to allow setting of the stream size of ASN.1 encodings. The value can\n be either in bytes, or appended with k (1 kilobyte blocks), m (1\n megabyte blocks), or g (1 gigabyte blocks).\n - Added NTRU+ support to the lightweight PQC API and the BCPQC provider.\n - Added SM4 key wrap/unwrap mode, SM2 key exchange, and logging to SM2Signer.\n - OpenPGP: Added encryption-key filtering by purpose, a new OpenPGPKey\n constructor, KeyPassphraseProvider-based passphrase change, wildcard\n (anonymous) recipient handling, and Web-of-Trust methods for\n third-party signature chains and delegations.\n - CMSSignedDataStreamGenerator can now support the generation of DER/DL\n encoded SignedData objects (note memory restrictions still apply).\n - It is now possible to add extra digest alorithm IDs to\n CMSSignedDataStreamGenerator when required.\n - Random numbers being generated for DSTU4145 signature calculations\n were 1 bit shorter than they could be. The code has been corrected\n to allow the generated numbers to occupy the full numeric range available.\n - HKDF implementation has been corrected to use multiple IKMs if available.\n - CompositePublic/PrivateKey builders had an issue identifying brainpool\n and EdDSA curves from the algorithm names due to an error in the OID\n mapping table. This has been fixed.\n - S/MIME: Fix AuthEnveloped support for AES192/GCM and AES256/GCM.\n - CMS: Use implicit tag for AuthEnvelopedData.authEncryptedContentInfo.encryptedContent.\n - Fixed Strings.split to handle delimiters at position 0.\n - Fixed FrodoKEM error sampling to be constant-time.\n - Fixed PKIXNameConstraintValidator to treat a DNS name as intersecting itself.\n - Fixed PKCS12 key stores not calling getInstance with the original provider\n (which was forcing provider registration).\n - A resource leak due to the SMIMESigned constructor leaving background\n threads hanging on MessagingException has been fixed.\n - OpenPGP: Fixed an issue where a custom signature creation time was\n ignored when generating message signatures.\n - OpenPGP: Fixed SKESK encoding for direct-S2K-encrypted messages.\n\n- Version 1.83:\n - Attempting to check a password on a stripped PGP would throw an\n exception. Checking the password on such a key will now always\n return false.\n - Fixed an issue in KangarooTwelve where premature absorption caused\n erroneous 168-byte padding; absorption is now delayed so correct\n final-byte padding is applied.\n - BCJSSE: Fix supported_versions creation for renegotiation handshake.\n - (D)TLS: Reneg info now oly offered with pre-1.3.\n - A generic \u0027COMPOSITE\u0027 algorithm name has been added as a JCA\n Signature algorithm. The algorithm will identify the composite\n signature to use from the composite key passed in.\n - The composite signatures implementation has been updated to the\n final draft and now follows the submitted standard.\n - Support for the generation and use as trust anchors has been added\n for certificate signatures with id-alg-unsigned as the signature type.\n - Support for CMP direct POP for encryption keys using\n challenge/response has been added to the CMP/CRMF APIs.\n - Support for SupportedCurves attribute to the BC provider\n - BCJSSE: Added support for SLH-DSA signature schemes in TLS 1.3 per\n draft-reddy-tls-slhdsa-01.\n - Support has been added for the Java 25 KDF API (current algorithms,\n PBKDF2, SCRYPT, and HKDF).\n - Support for composite signatures is now included in CMS and timestamping.\n - It is now possible to disable the Lenstra check in RSA where the public\n key is not available via the system/security property\n \u0027org.bouncycastle.rsa.no_lenstra_check\u0027.\n\n- Version 1.82:\n - SNOVA and MAYO are now correctly added to the JCA provider module-info file.\n - TLS: Avoid nonce reuse error in JCE AEAD workaround for pre-Java7.\n - BCJSSE: Session binding map is now shared across all stages of the\n session lifecycle (SunJSSE compatibility).\n - The CMCEPrivateKeyParameters#reconstructPublicKey method was returning\n an empty byte array. It now returns an encoding of the public key.\n - CBZip2InputStream no longer auto-closes at end-of-contents.\n - The BC CertPath implementation was eliminating certificates on the\n bases of the Key-ID. This is not in accordance with RFC 4158.\n - Support for the previous set of libOQS Falcon OIDs has been restored.\n - The BC CipherInputStream could throw an exception if asked to handle an\n AEAD stream consisting of the MAC only.\n - Some KeyAgreement classes were missing in the Java 11 class hierarchy.\n - Fix typo in a constant name in the HPKE class and deprecate the old constant.\n - Fuzzing analysis has been done on the OpenPGP API and additional code\n has been added to prevent escaping exceptions.\n - SHA3Digest, CSHAKE, TupleHash, KMAC now provide support for Memoable\n and EncodableService.\n - BCJSSE: Added support for integrity-only cipher suites in TLS 1.3 per RFC 9150.\n - BCJSSE: Added support for system properties \u0027jdk.tls.{client,server}.maxInboundCertificateChainLength\u0027\n - BCJSSE: Added support for ML-DSA signature schemes in TLS 1.3 per draft-ietf-tls-mldsa-00.\n - The Composite post-quantum signatures implementation has been updated to\n the latest draft (07) draft-ietf-lamps-pq-composite-sigs.\n - \u0027_PREHASH\u0027 implementations are now provided for all composite signatures\n to allow the hash of the date to be used instead of the actual data in\n signature calculation.\n - The gradle build can now be used to generate an Bill of Materials (BOM) file.\n - It is now possible to configure the SignerInfoVerifierBuilder used by the\n SignedMailValidator class.\n - The Ascon family of algorithms has been updated with the latest published changes.\n - Composite signature keys can now be constructed from the individual keys of\n the algorithms composing the composite.\n - PGPSecretKey, PGPSignatureGenerator now support version 6.\n - Further optimisation work has been done on ML-KEM public key validation.\n - Zeroization of passwords in the JCA PKCS12 key store has been improved.\n - The \u0027org.bouncycastle.drbg.effective_256bits_entropy\u0027 property has been\n added for platforms where the entropy source is not producing 1 full bit\n of entropy per bit and additional bits are required (default value 282).\n - OpenPGPKeyGenerator now allows for the use of empty UserIDs (version 4 compatibility).\n - The HQC KEM has been updated with the latest draft updates.\n - The legacy post-quantum package has now been removed.\n\n- Version 1.81:\n - A potention NullPointerException in the KEM KDF KemUtil class\n has been removed.\n - Overlapping input/output buffers in doFinal could result in\n data corruption.\n - Fixed Grain-128AEAD decryption incorrectly handle MAC verification.\n - Add configurable header validation to prevent malicious header\n injection in PGP cleartext signed messages; Fix signature packet\n encoding issues in PGPSignature.join() and embedded signatures\n while phasing out legacy format.\n - Fixed ParallelHash initialization stall when using block size B=0.\n - The PRF from the PBKDF2 function was been lost when PBMAC1 was\n initialized from protectionAlgorithm. This has been fixed.\n - The lowlevel DigestFactory was cloning MD5 when being asked\n to clone SHA1.\n - XWing implementation updated to draft-connolly-cfrg-xwing-kem/07/\n - Further support has been added for generation and use of PGP V6 keys\n - Additional validation has been added for armored headers in Cleartext\n Signed Messages.\n - The PQC signature algorithm proposal Mayo has been added to the\n low-level API and the BCPQC provider.\n - The PQC signature algorithm proposal Snova has been added to the\n low-level API and the BCPQC provider.\n - Support for ChaCha20-Poly1305 has been added to the CMS/SMIME APIs.\n - The Falcon implementation has been updated to the latest draft.\n - Support has been added for generating keys which encode as seed-only\n and expanded-key-only for ML-KEM and ML-DSA private keys.\n - Private key encoding of ML-DSA and ML-KEM private keys now follows\n the latest IETF draft.\n - The Ascon family of algorithms has been updated to the initial draft\n of SP 800-232. Some additional optimisation work has been done.\n - Support for ML-DSA\u0027s external-mu calculation and signing has been\n added to the BC provider.\n - CMS now supports ML-DSA for SignedData generation.\n - Introduce high-level OpenPGP API for message creation/consumption\n and certificate evaluation.\n - Added JDK21 KEM API implementation for HQC algorithm.\n - BCJSSE: Strip trailing dot from hostname for SNI, endpointID checks.\n - BCJSSE: Draft support for ML-KEM updated (draft-connolly-tls-mlkem-key-agreement-05).\n - BCJSSE: Draft support for hybrid ECDHE-MLKEM (draft-ietf-tls-ecdhe-mlkem-00).\n - BCJSSE: Optionally prefer TLS 1.3 server\u0027s supported_groups order\n (BCSSLParameters.useNamedGroupsOrder).\n\n- Version 1.80:\n - A splitting issue for ML-KEM led to an incorrect size for kemct\n in KEMRecipientInfos. This has been fixed.\n - The PKCS12 KeyStore has been adjusted to prevent accidental doubling\n of the Oracle trusted certificate attribute (results in an IOException\n when used with the JVM PKCS12 implementation).\n - The SignerInfoGenerator copy constructor was ignoring the certHolder field.\n - The getAlgorithm() method return value for a CompositePrivateKey was\n not consistent with the corresponding getAlgorithm() return value for\n the CompositePrivateKey. This has been fixed.\n - The international property files were missing from the bcjmail distribution.\n - Issues with ElephantEngine failing on processing large/multi-block messages\n have been addressed.\n - GCFB mode now fully resets on a reset.\n - The lightweight algorithm contestants: Elephant, ISAP, PhotonBeetle,\n Xoodyak now support the use of the AEADParameters class and provide\n accurate update/doFinal output lengths.\n - An unnecessary downcast in CertPathValidatorUtilities was resulting\n in the ignoring of URLs for FTP based CRLs.\n - A regression in the OpenPGP API could cause NoSuchAlgorithmException\n to be thrown when attempting to use SHA-256 in some contexts.\n - EtsiTs1029411TypesAuthorization was missing an extension field.\n - Interoperability issues with single depth LMS keys have been addressed.\n - CompositeSignatures now updated to draft-ietf-lamps-pq-composite-sigs-03.\n - ML-KEM, ML-DSA, SLH-DSA, and Composite private keys now use raw encodings\n as per the latest drafts from IETF 121: draft-ietf-lamps-kyber-certificates-06,\n draft-ietf-lamps-dilithium-certificates-05, and draft-ietf-lamps-x509-slhdsa.\n - Initial support has been added for RFC 9579 PBMAC1 in the PKCS API.\n - Support has been added for EC-JPAKE to the lightweight API.\n - Support has been added for the direct construction of S/MIME AuthEnvelopedData\n objects, via the SMIMEAuthEnvelopedData class.\n - An override \u0027org.bouncycastle.asn1.allow_wrong_oid_enc\u0027 property has been\n added to disable new OID encoding checks (use with caution).\n - Support has been added for the PBEParemeterSpec.getParameterSpec()\n method where supported by the JVM.\n - ML-DSA/SLH-DSA now return null for Signature.getParameters() if no context\n is provided. This allows the algorithms to be used with the existing Java key tool.\n - HQC has been updated to reflect the reference implementation released on 2024-10-30.\n - Support has been added to the low-level APIs for the OASIS Shamir Secret\n Splitting algorithms.\n - BCJSSE: System property \u0027org.bouncycastle.jsse.fips.allowGCMCiphersIn12\u0027\n no longer used. FIPS TLS 1.2 GCM suites can now be enabled according to\n JcaTlsCrypto#getFipsGCMNonceGeneratorFactory (see JavaDoc for details) if\n done in alignment with FIPS requirements.\n - Support has been added for OpenPGP V6 PKESK and message encryption.\n - PGPSecretKey.copyWithNewPassword() now includes AEAD support.\n - The ASCON family of algorithms have been updated in accordance with the\n published FIPS SP 800-232 draft.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-1639,SUSE-SLE-Module-Development-Tools-15-SP7-2026-1639,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1639,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1639,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1639,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1639,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1639,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1639,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1639,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1639,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1639,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1639",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1639-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:1639-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261639-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:1639-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025753.html"
},
{
"category": "self",
"summary": "SUSE Bug 1262225",
"url": "https://bugzilla.suse.com/1262225"
},
{
"category": "self",
"summary": "SUSE Bug 1262226",
"url": "https://bugzilla.suse.com/1262226"
},
{
"category": "self",
"summary": "SUSE Bug 1262227",
"url": "https://bugzilla.suse.com/1262227"
},
{
"category": "self",
"summary": "SUSE Bug 1262228",
"url": "https://bugzilla.suse.com/1262228"
},
{
"category": "self",
"summary": "SUSE Bug 1262232",
"url": "https://bugzilla.suse.com/1262232"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14813 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14813/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-0636 page",
"url": "https://www.suse.com/security/cve/CVE-2026-0636/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-3505 page",
"url": "https://www.suse.com/security/cve/CVE-2026-3505/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5588 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5588/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5598/"
}
],
"title": "Security update for bouncycastle",
"tracking": {
"current_release_date": "2026-04-28T11:10:37Z",
"generator": {
"date": "2026-04-28T11:10:37Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:1639-1",
"initial_release_date": "2026-04-28T11:10:37Z",
"revision_history": [
{
"date": "2026-04-28T11:10:37Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "bouncycastle-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-javadoc-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-javadoc-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-javadoc-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-jmail-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-jmail-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-jmail-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-mail-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-mail-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-mail-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-pg-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-pkix-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-tls-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-tls-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-tls-1.84-150200.3.35.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"product": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"product_id": "bouncycastle-util-1.84-150200.3.35.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-development-tools:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-150200.3.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-150200.3.35.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14813",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14813"
}
],
"notes": [
{
"category": "general",
"text": "Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher.\n\nGOSTCTR implementation unable to process more than 255 blocks correctly.\n\n\nThis issue affects BC-JAVA: from 1.59 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14813",
"url": "https://www.suse.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "SUSE Bug 1262225 for CVE-2025-14813",
"url": "https://bugzilla.suse.com/1262225"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-28T11:10:37Z",
"details": "important"
}
],
"title": "CVE-2025-14813"
},
{
"cve": "CVE-2026-0636",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-0636"
}
],
"notes": [
{
"category": "general",
"text": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.\n\nThis issue affects BC-JAVA: from 1.74 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-0636",
"url": "https://www.suse.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "SUSE Bug 1262226 for CVE-2026-0636",
"url": "https://bugzilla.suse.com/1262226"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-28T11:10:37Z",
"details": "moderate"
}
],
"title": "CVE-2026-0636"
},
{
"cve": "CVE-2026-3505",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-3505"
}
],
"notes": [
{
"category": "general",
"text": "Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.\n\nThis issue affects BC-JAVA: from 1.74 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-3505",
"url": "https://www.suse.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "SUSE Bug 1262232 for CVE-2026-3505",
"url": "https://bugzilla.suse.com/1262232"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-28T11:10:37Z",
"details": "important"
}
],
"title": "CVE-2026-3505"
},
{
"cve": "CVE-2026-5588",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5588"
}
],
"notes": [
{
"category": "general",
"text": "Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java.\n\nThis issue affects BC-JAVA: from 1.67 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5588",
"url": "https://www.suse.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "SUSE Bug 1262228 for CVE-2026-5588",
"url": "https://bugzilla.suse.com/1262228"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-28T11:10:37Z",
"details": "moderate"
}
],
"title": "CVE-2026-5588"
},
{
"cve": "CVE-2026-5598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5598"
}
],
"notes": [
{
"category": "general",
"text": "Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java.\n\nThis issue affects BC-JAVA: from 1.71 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5598",
"url": "https://www.suse.com/security/cve/CVE-2026-5598"
},
{
"category": "external",
"summary": "SUSE Bug 1262227 for CVE-2026-5598",
"url": "https://bugzilla.suse.com/1262227"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:bouncycastle-util-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pg-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-pkix-1.84-150200.3.35.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:bouncycastle-util-1.84-150200.3.35.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-28T11:10:37Z",
"details": "important"
}
],
"title": "CVE-2026-5598"
}
]
}
SUSE-SU-2026:21404-1
Vulnerability from csaf_suse - Published: 2026-04-24 15:54 - Updated: 2026-04-24 15:54Summary
Security update for bouncycastle
Severity
Important
Notes
Title of the patch: Security update for bouncycastle
Description of the patch: This update for bouncycastle fixes the following issues:
- Update to version 1.84:
- CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly (bsc#1262225).
- CVE-2026-0636: LDAP Injection Vulnerability in LDAPStoreHelper.java (bsc#1262226).
- CVE-2026-3505: Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (bsc#1262232).
- CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature sequence as valid (bsc#1262228).
- CVE-2026-5598: Non-constant time comparisons risk private key leakage in FrodoKEM (bsc#1262227).
Patchnames: SUSE-SLES-16.0-643
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.6 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
8.6 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
24 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for bouncycastle",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for bouncycastle fixes the following issues:\n\n- Update to version 1.84:\n- CVE-2025-14813: GOSTCTR implementation unable to process more than 255 blocks correctly (bsc#1262225).\n- CVE-2026-0636: LDAP Injection Vulnerability in LDAPStoreHelper.java (bsc#1262226).\n- CVE-2026-3505: Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (bsc#1262232).\n- CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature sequence as valid (bsc#1262228).\n- CVE-2026-5598: Non-constant time comparisons risk private key leakage in FrodoKEM (bsc#1262227).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-643",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_21404-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:21404-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202621404-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:21404-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/046131.html"
},
{
"category": "self",
"summary": "SUSE Bug 1262225",
"url": "https://bugzilla.suse.com/1262225"
},
{
"category": "self",
"summary": "SUSE Bug 1262226",
"url": "https://bugzilla.suse.com/1262226"
},
{
"category": "self",
"summary": "SUSE Bug 1262227",
"url": "https://bugzilla.suse.com/1262227"
},
{
"category": "self",
"summary": "SUSE Bug 1262228",
"url": "https://bugzilla.suse.com/1262228"
},
{
"category": "self",
"summary": "SUSE Bug 1262232",
"url": "https://bugzilla.suse.com/1262232"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14813 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14813/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-0636 page",
"url": "https://www.suse.com/security/cve/CVE-2026-0636/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-3505 page",
"url": "https://www.suse.com/security/cve/CVE-2026-3505/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5588 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5588/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-5598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-5598/"
}
],
"title": "Security update for bouncycastle",
"tracking": {
"current_release_date": "2026-04-24T15:54:52Z",
"generator": {
"date": "2026-04-24T15:54:52Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:21404-1",
"initial_release_date": "2026-04-24T15:54:52Z",
"revision_history": [
{
"date": "2026-04-24T15:54:52Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "bouncycastle-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-javadoc-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-javadoc-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-javadoc-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-jmail-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-jmail-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-jmail-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-mail-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-mail-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-mail-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-pg-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-pg-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-pg-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-pkix-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-pkix-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-pkix-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-tls-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-tls-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-tls-1.84-160000.1.1.noarch"
}
},
{
"category": "product_version",
"name": "bouncycastle-util-1.84-160000.1.1.noarch",
"product": {
"name": "bouncycastle-util-1.84-160000.1.1.noarch",
"product_id": "bouncycastle-util-1.84-160000.1.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16.0"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-javadoc-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-javadoc-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-jmail-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-jmail-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-mail-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-mail-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-tls-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-tls-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-javadoc-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-javadoc-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-jmail-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-jmail-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-mail-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-mail-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pg-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-pg-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-pkix-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-pkix-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-tls-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-tls-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bouncycastle-util-1.84-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
},
"product_reference": "bouncycastle-util-1.84-160000.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14813",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14813"
}
],
"notes": [
{
"category": "general",
"text": "Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher.\n\nGOSTCTR implementation unable to process more than 255 blocks correctly.\n\n\nThis issue affects BC-JAVA: from 1.59 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14813",
"url": "https://www.suse.com/security/cve/CVE-2025-14813"
},
{
"category": "external",
"summary": "SUSE Bug 1262225 for CVE-2025-14813",
"url": "https://bugzilla.suse.com/1262225"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-24T15:54:52Z",
"details": "important"
}
],
"title": "CVE-2025-14813"
},
{
"cve": "CVE-2026-0636",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-0636"
}
],
"notes": [
{
"category": "general",
"text": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.\n\nThis issue affects BC-JAVA: from 1.74 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-0636",
"url": "https://www.suse.com/security/cve/CVE-2026-0636"
},
{
"category": "external",
"summary": "SUSE Bug 1262226 for CVE-2026-0636",
"url": "https://bugzilla.suse.com/1262226"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-24T15:54:52Z",
"details": "moderate"
}
],
"title": "CVE-2026-0636"
},
{
"cve": "CVE-2026-3505",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-3505"
}
],
"notes": [
{
"category": "general",
"text": "Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.Java, JceAEADUtil.Java, OperatorHelper.Java.\n\nThis issue affects BC-JAVA: from 1.74 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-3505",
"url": "https://www.suse.com/security/cve/CVE-2026-3505"
},
{
"category": "external",
"summary": "SUSE Bug 1262232 for CVE-2026-3505",
"url": "https://bugzilla.suse.com/1262232"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-24T15:54:52Z",
"details": "important"
}
],
"title": "CVE-2026-3505"
},
{
"cve": "CVE-2026-5588",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5588"
}
],
"notes": [
{
"category": "general",
"text": "Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All (pkix modules). This vulnerability is associated with program files JcaContentVerifierProviderBuilder.Java.\n\nThis issue affects BC-JAVA: from 1.67 before 1.84; BCPKIX-FIPS: from 2.0.6 before 2.0.11, from 2.1.7 before 2.1.11.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5588",
"url": "https://www.suse.com/security/cve/CVE-2026-5588"
},
{
"category": "external",
"summary": "SUSE Bug 1262228 for CVE-2026-5588",
"url": "https://bugzilla.suse.com/1262228"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-24T15:54:52Z",
"details": "moderate"
}
],
"title": "CVE-2026-5588"
},
{
"cve": "CVE-2026-5598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-5598"
}
],
"notes": [
{
"category": "general",
"text": "Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java.\n\nThis issue affects BC-JAVA: from 1.71 before 1.84.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-5598",
"url": "https://www.suse.com/security/cve/CVE-2026-5598"
},
{
"category": "external",
"summary": "SUSE Bug 1262227 for CVE-2026-5598",
"url": "https://bugzilla.suse.com/1262227"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-javadoc-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-jmail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-mail-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pg-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-pkix-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-tls-1.84-160000.1.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:bouncycastle-util-1.84-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-24T15:54:52Z",
"details": "important"
}
],
"title": "CVE-2026-5598"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…