Red Hat Security Advisory

RHSA-2024:8886

Red Hat Product OCP Tools 4.12 Openshift Jenkins security update

Released 2024-11-05 · Red Hat rating Important · View on Red Hat →

Fixed in

OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1730119231-1.el8, jenkins-2.462.3.1730119132-3.el8

Fixes 5 records

TI-2024-22597 CVE-2024-34144 · GHSA-v63g-v339-2673

Protection mechanism failure in Jenkins Script Security Plugin

HIGH 79

A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipeli…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.48361 Published 2024-05-02 Partial fix · 1336.vf33a CWE-693

TI-2021-20145 CVE-2021-44549 · GHSA-c69w-jj56-834w

SMTPS server hostname not checked when making TLS connection to SMTPS server

LOW 37

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.02081 Published 2021-12-14 Partial fix · 2.0 CWE-295

TI-2024-32071 CVE-2024-47803 · GHSA-pj95-ph4q-4qm4

Information disclosure through error messages in Jenkins

LOW 22

Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form field.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00822 Published 2024-10-02 Fixed in 2.462.3, 2.479 CWE-209

TI-2024-32072 CVE-2024-47804 · GHSA-f9qj-77q2-h5c5

Type confusion in Jenkins

LOW 21

If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Je…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00669 Published 2024-10-02 Fixed in 2.462.3, 2.479 CWE-843

TI-2024-26035 CVE-2024-38808 · GHSA-9cmq-m9j5-mvww

CVE-2024-38808: Spring Expression DoS Vulnerability

LOW 21

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) c…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00568 Published 2024-08-20 Partial fix · 5.3.39, 6.0+ CWE-770