Red Hat Security Advisory

RHSA-2026:10201

Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.

Released 2026-04-23 · Red Hat rating Important · View on Red Hat →

Fixed in

OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8

Fixes 4 records

TI-2024-19434 CVE-2024-29371 · GHSA-3677-xxcr-wjqv

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by…

HIGH 72

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00257 Published 2025-12-17 Partial fix · 0.9.6 CWE-1259

TI-2026-25449 CVE-2026-33001 · GHSA-r6qv-frpc-q66c

Link following in Jenkins

MEDIUM 44

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesyst…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02113 Published 2026-03-18 Partial fix · 2.555, 2.541.3 CWE-59

TI-2026-21558 CVE-2026-27099 · GHSA-85h6-5m3v-gx37

Cross-site scripting in Jenkins

LOW 37

Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site s…

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00481 Published 2026-02-18 Partial fix · 2.551, 2.541.2 CWE-79

TI-2026-21559 CVE-2026-27100 · GHSA-wfhp-qgm8-5p5c

Information disclosure in Jenkins

LOW 20

Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not have access to, allowing attackers with Item/Build and Item/Configure permission…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0037 Published 2026-02-18 Partial fix · 2.551, 2.541.2 CWE-200