Read the docs
Red Hat Security Advisory

RHSA-2020:5102

OpenShift Container Platform 3.11.318 jenkins-2-plugins security update

Released 2020-11-17 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 3 records

TI-2020-02131 CVE-2020-2254 · GHSA-vq7j-6pcq-f48p

Path traversal in Jenkins Blue Ocean Plugin

Priority LOW 33

Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02118 Published 2020-09-16 Fixed in 1.19.2, 1.23.3 CWE-22
TI-2020-02129 CVE-2020-2252 · GHSA-6fr3-286q-q3cr

Improper certificate validation in Jenkins Mailer Plugin

Priority LOW 24

Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00959 Published 2020-09-16 Fixed in 1.29.1, 1.31.1 +1 CWE-295
TI-2020-02132 CVE-2020-2255 · GHSA-vc7g-4269-f7hw

Missing authorization in Jenkins Blue Ocean Plugin

Priority LOW 22

A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00865 Published 2020-09-16 Fixed in 1.19.2, 1.23.3 CWE-862