RHSA-2025:23487
Vulnerability from csaf_redhat - Published: 2025-12-17 13:41 - Updated: 2025-12-17 14:50Summary
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
Notes
Topic
An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12.
Details
Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12.",
"title": "Topic"
},
{
"category": "general",
"text": "Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23487",
"url": "https://access.redhat.com/errata/RHSA-2025:23487"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-4949",
"url": "https://access.redhat.com/security/cve/CVE-2025-4949"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-67635",
"url": "https://access.redhat.com/security/cve/CVE-2025-67635"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23487.json"
}
],
"title": "Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.",
"tracking": {
"current_release_date": "2025-12-17T14:50:23+00:00",
"generator": {
"date": "2025-12-17T14:50:23+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.14"
}
},
"id": "RHSA-2025:23487",
"initial_release_date": "2025-12-17T13:41:30+00:00",
"revision_history": [
{
"date": "2025-12-17T13:41:30+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-17T13:41:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-17T14:50:23+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 4.12",
"product": {
"name": "OpenShift Developer Tools and Services 4.12",
"product_id": "OpenShift Developer Tools and Services 4.12",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ocp_tools:4.12::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3A2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4\u0026tag=v4.12.0-1765820400"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3_amd64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3_amd64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-rhel8@sha256%3A30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3?arch=amd64\u0026repository_url=registry.redhat.io/ocp-tools-4\u0026tag=v4.12.0-1765819949"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:cc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f_arm64",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:cc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f_arm64",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:cc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3Acc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f?arch=arm64\u0026repository_url=registry.redhat.io/ocp-tools-4\u0026tag=v4.12.0-1765820400"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:e3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4_ppc64le",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:e3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4_ppc64le",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:e3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3Ae3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4?arch=ppc64le\u0026repository_url=registry.redhat.io/ocp-tools-4\u0026tag=v4.12.0-1765820400"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6_s390x",
"product": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6_s390x",
"product_id": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jenkins-agent-base-rhel8@sha256%3Ab0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6?arch=s390x\u0026repository_url=registry.redhat.io/ocp-tools-4\u0026tag=v4.12.0-1765820400"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89_amd64 as a component of OpenShift Developer Tools and Services 4.12",
"product_id": "OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6_s390x as a component of OpenShift Developer Tools and Services 4.12",
"product_id": "OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6_s390x"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:cc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f_arm64 as a component of OpenShift Developer Tools and Services 4.12",
"product_id": "OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:cc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f_arm64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:cc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:e3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4_ppc64le as a component of OpenShift Developer Tools and Services 4.12",
"product_id": "OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:e3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4_ppc64le"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:e3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3_amd64 as a component of OpenShift Developer Tools and Services 4.12",
"product_id": "OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3_amd64"
},
"product_reference": "registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 4.12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-4949",
"cwe": {
"id": "CWE-827",
"name": "Improper Control of Document Type Definition"
},
"discovery_date": "2025-05-21T07:00:48.762597+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6_s390x",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:cc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f_arm64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:e3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2367730"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse JGit. This vulnerability can allow information disclosure, denial of service, and other security issues when parsing XML files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.eclipse.jgit: XXE vulnerability in Eclipse JGit",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6_s390x",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:cc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f_arm64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:e3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-4949"
},
{
"category": "external",
"summary": "RHBZ#2367730",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2367730"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-4949",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4949"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-4949",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4949"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/64",
"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/64"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281",
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281"
},
{
"category": "external",
"summary": "https://projects.eclipse.org/projects/technology.jgit/releases/7.2.1",
"url": "https://projects.eclipse.org/projects/technology.jgit/releases/7.2.1"
}
],
"release_date": "2025-05-21T06:47:19.777000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T13:41:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This update includes a newer OpenShift client (oc) version bundled in the image. If your Jenkins pipelines require a specific oc version, configure it explicitly using the Jenkins pipeline tools directive.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23487"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6_s390x",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:cc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f_arm64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:e3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4_ppc64le",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.eclipse.jgit: XXE vulnerability in Eclipse JGit"
},
{
"cve": "CVE-2025-67635",
"cwe": {
"id": "CWE-459",
"name": "Incomplete Cleanup"
},
"discovery_date": "2025-12-10T17:01:24.450765+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6_s390x",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:cc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f_arm64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:e3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2420998"
}
],
"notes": [
{
"category": "description",
"text": "Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.jenkins-ci.main/jenkins-core: Jenkins HTTP connection mis-handling",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3_amd64"
],
"known_not_affected": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6_s390x",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:cc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f_arm64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:e3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-67635"
},
{
"category": "external",
"summary": "RHBZ#2420998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2420998"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-67635",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67635"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-67635",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67635"
},
{
"category": "external",
"summary": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3630",
"url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3630"
}
],
"release_date": "2025-12-10T16:50:35.491000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T13:41:30+00:00",
"details": "It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12 upgrade to the latest. This update includes a newer OpenShift client (oc) version bundled in the image. If your Jenkins pipelines require a specific oc version, configure it explicitly using the Jenkins pipeline tools directive.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23487"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6_s390x",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:cc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f_arm64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:e3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4_ppc64le",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:2cf352e9c89a8f4bce884f49629b7c84e1352c5cd64e095ae26c2664ecc6bd89_amd64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:b0095ccfcf007894612189549ae7d931bb40fe52a923b963b678d5a6c67022e6_s390x",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:cc5db9e93a9e2fccd44aef2bdf018943cce058c35d11977326003481b65a866f_arm64",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:e3d5be4a078ae7954f167f855d15bb0f6fc34b426928a26ff4d30b41f41549a4_ppc64le",
"OpenShift Developer Tools and Services 4.12:registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:30b043d6c77a18e0f3ff2e30da493588d9c7b6cc91ff887100ef869853e264f3_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.jenkins-ci.main/jenkins-core: Jenkins HTTP connection mis-handling"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…