Read the docs
Red Hat Security Advisory

RHSA-2019:1636

OpenShift Container Platform 4.1 jenkins-2-plugins security update

Released 2019-07-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 3 records

TI-2019-07637 CVE-2019-10328 · GHSA-v558-fhw2-v46w

Protection mechanism failure in Jenkins Pipeline Remote Loader Plugin

Priority MEDIUM 46

Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.

CVSS 3.0CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01939 Published 2019-05-31 Partial fix · 1.5 CWE-693
TI-2019-07646 CVE-2019-10337 · GHSA-g6h2-4x64-c59x

XML external entity injection in Jenkins Token Macro Plugin

Priority LOW 37

An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities,…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02038 Published 2019-06-11 Partial fix · 2.8 CWE-611
TI-2019-07629 CVE-2019-10320 · GHSA-xm94-9jw8-p6hw

Information disclosure in Jenkins Credentials Plugin

Priority LOW 22

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certific…

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0097 Published 2019-05-21 Partial fix · 2.1.19 CWE-538