Red Hat Security Advisory

RHSA-2024:8887

Red Hat Product OCP Tools 4.13 Openshift Jenkins security update

Released 2024-11-05 · Red Hat rating Important · View on Red Hat →

Fixed in

OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1729840148-1.el8, jenkins-2.462.3.1729839924-3.el8

Fixes 4 records

TI-2021-20145 CVE-2021-44549 · GHSA-c69w-jj56-834w

SMTPS server hostname not checked when making TLS connection to SMTPS server

LOW 37

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.02081 Published 2021-12-14 Partial fix · 2.0 CWE-295

TI-2024-32071 CVE-2024-47803 · GHSA-pj95-ph4q-4qm4

Information disclosure through error messages in Jenkins

LOW 22

Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form field.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00822 Published 2024-10-02 Fixed in 2.462.3, 2.479 CWE-209

TI-2024-32072 CVE-2024-47804 · GHSA-f9qj-77q2-h5c5

Type confusion in Jenkins

LOW 21

If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Je…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00669 Published 2024-10-02 Fixed in 2.462.3, 2.479 CWE-843

TI-2024-26035 CVE-2024-38808 · GHSA-9cmq-m9j5-mvww

CVE-2024-38808: Spring Expression DoS Vulnerability

LOW 21

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) c…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00568 Published 2024-08-20 Partial fix · 5.3.39, 6.0+ CWE-770