Red Hat Security Advisory

RHSA-2025:2223

Red Hat Product OCP Tools 4.12 Openshift Jenkins security update

Released 2025-03-04 · Red Hat rating Important · View on Red Hat →

Fixed in

OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1740464689-1.el8, jenkins-2.479.3.1740464431-3.el8

Fixes 6 records

TI-2024-31454 CVE-2024-47072 · GHSA-hfq9-hggm-c56q

XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream

MEDIUM 43

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02001 Published 2024-11-07 Partial fix · 1.4.21 CWE-121

TI-2024-32114 CVE-2024-47855 · GHSA-wwcp-26wc-3fxm

util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.

MEDIUM 41

util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.17565 Published 2024-10-04 Partial fix · 3.1.0

TI-2024-35218 CVE-2024-52551 · GHSA-p2qq-c693-q53w

Incorrect default permissions in Jenkins Pipeline: Declarative Plugin

LOW 38

Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Buil…

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00587 Published 2024-11-13 Fixed in 2.2218.v56d0cda CWE-276

TI-2024-35217 CVE-2024-52550 · GHSA-mrpr-vr82-x88r

Improper authorization in Jenkins Pipeline: Groovy Plugin

LOW 37

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build per…

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00456 Published 2024-11-13 Fixed in 3993.v3e20a CWE-354

TI-2024-30409 CVE-2024-45339 · GHSA-6wxm-mpqj-6jpf

Vulnerability when creating log files in github.com/golang/glog

LOW 33

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00318 Published 2025-01-28 Partial fix · 1.2.4 CWE-377

TI-2024-35216 CVE-2024-52549 · GHSA-jv82-75fh-23r7

Missing authorization in Jenkins Script Security Plugin

LOW 20

Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attac…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00352 Published 2024-11-13 Fixed in 1368.vb CWE-862