rhsa-2025:2220
Vulnerability from csaf_redhat
Published
2025-03-04 14:39
Modified
2025-03-19 19:40
Summary
Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 Openshift Jenkins security update

Notes

Topic
An update for Openshift Jenkins is now available for Red Hat Product OCP Tools 4.15. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Security Fix(es): * org.jenkinsci.plugins/pipeline-model-definition: Jenkins Pipeline Declarative Plugin Allows Restart of Builds with Unapproved Jenkinsfile(CVE-2024-52551) * org.jenkins-ci.plugins/script-security: Jenkins Script Security Plugin File Disclosure Vulnerability(CVE-2024-52549) * org.jenkins-ci.plugins.workflow/workflow-cps: Lack of Approval Check for Rebuilt Jenkins Pipelines(CVE-2024-52550) * jenkins: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream(CVE-2024-47072) * jenkins: Mishandling of an unbalanced comment string in json-lib(CVE-2024-47855) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update for Openshift Jenkins is now available for Red Hat Product OCP Tools 4.15.\nRed Hat Product Security has rated this update as having a security impact of important.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating,\nis available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Jenkins is a continuous integration server that monitors executions of repeated\njobs, such as building a software project or jobs run by cron.\n\nSecurity Fix(es):\n\n* org.jenkinsci.plugins/pipeline-model-definition: Jenkins Pipeline\nDeclarative Plugin Allows Restart of Builds with Unapproved\nJenkinsfile(CVE-2024-52551)\n* org.jenkins-ci.plugins/script-security: Jenkins Script Security Plugin\nFile Disclosure Vulnerability(CVE-2024-52549)\n* org.jenkins-ci.plugins.workflow/workflow-cps: Lack of Approval Check for\nRebuilt Jenkins Pipelines(CVE-2024-52550)\n* jenkins: XStream is vulnerable to a Denial of Service attack due to stack\noverflow from a manipulated binary input stream(CVE-2024-47072)\n* jenkins: Mishandling of an unbalanced comment string in\njson-lib(CVE-2024-47855)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments,\nand other related information, refer to the CVE page listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2025:2220",
            url: "https://access.redhat.com/errata/RHSA-2025:2220",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "2316421",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2316421",
         },
         {
            category: "external",
            summary: "2324606",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2324606",
         },
         {
            category: "external",
            summary: "2326034",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2326034",
         },
         {
            category: "external",
            summary: "2326043",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2326043",
         },
         {
            category: "external",
            summary: "2326047",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2326047",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2220.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 Openshift Jenkins security update",
      tracking: {
         current_release_date: "2025-03-19T19:40:10+00:00",
         generator: {
            date: "2025-03-19T19:40:10+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.1",
            },
         },
         id: "RHSA-2025:2220",
         initial_release_date: "2025-03-04T14:39:42+00:00",
         revision_history: [
            {
               date: "2025-03-04T14:39:42+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2025-03-04T14:39:42+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-03-19T19:40:10+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "OpenShift Developer Tools and Services for OCP 4.15",
                        product: {
                           name: "OpenShift Developer Tools and Services for OCP 4.15",
                           product_id: "8Base-OCP-Tools-4.15",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:ocp_tools:4.15::el8",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "OpenShift Jenkins",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "jenkins-0:2.479.3.1740051993-3.el8.src",
                        product: {
                           name: "jenkins-0:2.479.3.1740051993-3.el8.src",
                           product_id: "jenkins-0:2.479.3.1740051993-3.el8.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/jenkins@2.479.3.1740051993-3.el8?arch=src",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
                        product: {
                           name: "jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
                           product_id: "jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/jenkins-2-plugins@4.15.1740052174-1.el8?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "jenkins-0:2.479.3.1740051993-3.el8.noarch",
                        product: {
                           name: "jenkins-0:2.479.3.1740051993-3.el8.noarch",
                           product_id: "jenkins-0:2.479.3.1740051993-3.el8.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/jenkins@2.479.3.1740051993-3.el8?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                        product: {
                           name: "jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                           product_id: "jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/jenkins-2-plugins@4.15.1740052174-1.el8?arch=noarch",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "jenkins-0:2.479.3.1740051993-3.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.15",
               product_id: "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
            },
            product_reference: "jenkins-0:2.479.3.1740051993-3.el8.noarch",
            relates_to_product_reference: "8Base-OCP-Tools-4.15",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jenkins-0:2.479.3.1740051993-3.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.15",
               product_id: "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
            },
            product_reference: "jenkins-0:2.479.3.1740051993-3.el8.src",
            relates_to_product_reference: "8Base-OCP-Tools-4.15",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch as a component of OpenShift Developer Tools and Services for OCP 4.15",
               product_id: "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
            },
            product_reference: "jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
            relates_to_product_reference: "8Base-OCP-Tools-4.15",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jenkins-2-plugins-0:4.15.1740052174-1.el8.src as a component of OpenShift Developer Tools and Services for OCP 4.15",
               product_id: "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
            },
            product_reference: "jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
            relates_to_product_reference: "8Base-OCP-Tools-4.15",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2024-47072",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2024-11-08T13:47:39.374198+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2324606",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the XStream library. A remote attacker may trigger a denial of service by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. This issue may lead to the termination of the application.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "com.thoughtworks.xstream: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This vulnerability in XStream is considered an Important severity rather than Moderate because it exposes applications to a denial of service (DoS) attack with relative ease. By exploiting the flaw in the `BinaryStreamDriver`, an attacker can manipulate the binary input stream to trigger a stack overflow, which terminates the application unexpectedly. Unlike moderate vulnerabilities, which may require specific conditions or limited privileges, this flaw enables remote attackers to forcefully terminate services by crafting malicious input, impacting system availability. Additionally, the vulnerability’s reliance on a common serialization mechanism elevates the risk, as it may affect applications across various environments and industries where XStream is deployed.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
               "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
               "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
               "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-47072",
            },
            {
               category: "external",
               summary: "RHBZ#2324606",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2324606",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-47072",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-47072",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-47072",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-47072",
            },
            {
               category: "external",
               summary: "https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266",
               url: "https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266",
            },
            {
               category: "external",
               summary: "https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q",
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q",
            },
            {
               category: "external",
               summary: "https://x-stream.github.io/CVE-2024-47072.html",
               url: "https://x-stream.github.io/CVE-2024-47072.html",
            },
         ],
         release_date: "2024-11-07T23:38:52.978000+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-04T14:39:42+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2220",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "com.thoughtworks.xstream: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream",
      },
      {
         cve: "CVE-2024-47855",
         cwe: {
            id: "CWE-1286",
            name: "Improper Validation of Syntactic Correctness of Input",
         },
         discovery_date: "2024-10-04T06:00:55.617408+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2316421",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in JSON-lib's JSONTokener component. This vulnerability allows a denial of service via an unbalanced comment string.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "json-lib: Mishandling of an unbalanced comment string in json-lib",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
               "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
               "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
               "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-47855",
            },
            {
               category: "external",
               summary: "RHBZ#2316421",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2316421",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-47855",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-47855",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-47855",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-47855",
            },
            {
               category: "external",
               summary: "https://github.com/advisories/GHSA-wwcp-26wc-3fxm",
               url: "https://github.com/advisories/GHSA-wwcp-26wc-3fxm",
            },
            {
               category: "external",
               summary: "https://github.com/kordamp/json-lib/commit/a0c4a0eae277130e22979cf307c95dec4005a78e",
               url: "https://github.com/kordamp/json-lib/commit/a0c4a0eae277130e22979cf307c95dec4005a78e",
            },
            {
               category: "external",
               summary: "https://github.com/kordamp/json-lib/compare/v3.0.3...v3.1.0",
               url: "https://github.com/kordamp/json-lib/compare/v3.0.3...v3.1.0",
            },
         ],
         release_date: "2024-10-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-04T14:39:42+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2220",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "json-lib: Mishandling of an unbalanced comment string in json-lib",
      },
      {
         cve: "CVE-2024-52549",
         cwe: {
            id: "CWE-862",
            name: "Missing Authorization",
         },
         discovery_date: "2024-11-13T21:01:25.191886+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2326034",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Jenkins Script Security Plugin. This vulnerability allows attackers with Overall/Read permission to check for the existence of files on the controller file system via a method that implements form validation that does not perform a permission check.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jenkins-plugin/script-security: Jenkins Script Security Plugin File Disclosure Vulnerability",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
               "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
               "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
               "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-52549",
            },
            {
               category: "external",
               summary: "RHBZ#2326034",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2326034",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-52549",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-52549",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-52549",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-52549",
            },
            {
               category: "external",
               summary: "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3447",
               url: "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3447",
            },
         ],
         release_date: "2024-11-13T20:53:00.291000+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-04T14:39:42+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2220",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jenkins-plugin/script-security: Jenkins Script Security Plugin File Disclosure Vulnerability",
      },
      {
         cve: "CVE-2024-52550",
         cwe: {
            id: "CWE-862",
            name: "Missing Authorization",
         },
         discovery_date: "2024-11-13T21:02:09.374298+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2326043",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Jenkins Pipeline: Groovy Plugin (jenkins-plugin/workflow-cps). This vulnerability allows attackers with Item/Build permission to rebuild a previous build whose main (Jenkinsfile) script is no longer approved, bypassing script approval checks via the rebuild action.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jenkins-plugin/workflow-cps: Lack of Approval Check for Rebuilt Jenkins Pipelines",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This vulnerability is considered of important severity rather than moderate because it allows attackers with the `Item/Build` permission to trigger the execution of previously unapproved Jenkinsfiles during the rebuild process. Jenkinsfiles often contain critical pipeline scripts that can interact with sensitive systems and data, including environment variables, credentials, and system configurations. If these scripts are not properly approved, malicious or unauthorized code could be executed, potentially leading to arbitrary code execution, privilege escalation, or data manipulation. The lack of a re-approval check for rebuilt builds bypasses essential security controls, which can be exploited by attackers to gain unauthorized access or compromise the integrity of the build process.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
               "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
               "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
               "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-52550",
            },
            {
               category: "external",
               summary: "RHBZ#2326043",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2326043",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-52550",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-52550",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-52550",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-52550",
            },
            {
               category: "external",
               summary: "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3362",
               url: "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3362",
            },
         ],
         release_date: "2024-11-13T20:53:00.972000+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-04T14:39:42+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2220",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "jenkins-plugin/workflow-cps: Lack of Approval Check for Rebuilt Jenkins Pipelines",
      },
      {
         cve: "CVE-2024-52551",
         cwe: {
            id: "CWE-862",
            name: "Missing Authorization",
         },
         discovery_date: "2024-11-13T21:02:23.613996+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2326047",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Jenkins Pipeline: Declarative Plugin (pipeline-model-definition). This vulnerability allows attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved via insufficient script approval checks.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jenkins-plugin/pipeline-model-definition: Jenkins Pipeline Declarative Plugin Allows Restart of Builds with Unapproved Jenkinsfile",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This vulnerability is rated as Important due to the risk it poses by allowing attackers with Item/Build permissions to restart a previous build using an unapproved Jenkinsfile script, this could result in unauthorized execution of scripts, compromising the integrity of the build process.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
               "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
               "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
               "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-52551",
            },
            {
               category: "external",
               summary: "RHBZ#2326047",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2326047",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-52551",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-52551",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-52551",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-52551",
            },
            {
               category: "external",
               summary: "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3361",
               url: "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3361",
            },
         ],
         release_date: "2024-11-13T20:53:01.666000+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-04T14:39:42+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2220",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-0:2.479.3.1740051993-3.el8.src",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.noarch",
                  "8Base-OCP-Tools-4.15:jenkins-2-plugins-0:4.15.1740052174-1.el8.src",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "jenkins-plugin/pipeline-model-definition: Jenkins Pipeline Declarative Plugin Allows Restart of Builds with Unapproved Jenkinsfile",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.