RedHat: RHSA-2023-3299:01 Important: jenkins and jenkins-2-plugins security
Summary
Jenkins is a continuous integration server that monitors executions of
repeated jobs, such as building a software project or jobs run by cron.
Security Fix(es):
* apache-commons-text: variable interpolation RCE (CVE-2022-42889)
* google-oauth-client: missing PKCE support in accordance with the RFC for
OAuth 2.0 for Native Apps can lead to improper authorization
(CVE-2020-7692)
* jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script
Security Plugin (CVE-2023-24422)
* kubernetes-client: Insecure deserialization in unmarshalYaml method
(CVE-2021-4178)
* jackson-databind: Possible DoS if using JDK serialization to serialize
JsonNode (CVE-2021-46877)
* springframework: Authorization Bypass in RegexRequestMatcher
(CVE-2022-22978)
* xstream: Xstream to serialise XML data was vulnerable to Denial of
Service attacks (CVE-2022-40151)
* woodstox-core: woodstox to serialise XML data was vulnerable to Denial of
Service attacks (CVE-2022-40152)
* Apache Commons FileUpload: FileUpload DoS with excessive parts
(CVE-2023-24998)
* jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin
(CVE-2023-25761)
* jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in
Pipeline: Build Step Plugin (CVE-2023-25762)
* Jenkins: Denial of Service attack (CVE-2023-27900)
* Jenkins: Denial of Service attack (CVE-2023-27901)
* Jenkins: Workspace temporary directories accessible through directory
browser (CVE-2023-27902)
* Jenkins: Information disclosure through error stack traces related to
agents (CVE-2023-27904)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Summary
Solution
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
References
https://access.redhat.com/security/cve/CVE-2020-7692 https://access.redhat.com/security/cve/CVE-2021-4178 https://access.redhat.com/security/cve/CVE-2021-46877 https://access.redhat.com/security/cve/CVE-2022-22978 https://access.redhat.com/security/cve/CVE-2022-40151 https://access.redhat.com/security/cve/CVE-2022-40152 https://access.redhat.com/security/cve/CVE-2022-42889 https://access.redhat.com/security/cve/CVE-2023-24422 https://access.redhat.com/security/cve/CVE-2023-24998 https://access.redhat.com/security/cve/CVE-2023-25761 https://access.redhat.com/security/cve/CVE-2023-25762 https://access.redhat.com/security/cve/CVE-2023-27900 https://access.redhat.com/security/cve/CVE-2023-27901 https://access.redhat.com/security/cve/CVE-2023-27902 https://access.redhat.com/security/cve/CVE-2023-27904 https://access.redhat.com/security/updates/classification/#important
Package List
OpenShift Developer Tools and Services for OCP 4.13 for RHEL 8:
Source:
jenkins-2-plugins-4.13.1684911916-1.el8.src.rpm
jenkins-2.387.3.1684911776-3.el8.src.rpm
noarch:
jenkins-2-plugins-4.13.1684911916-1.el8.noarch.rpm
jenkins-2.387.3.1684911776-3.el8.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
Topic
An update for jenkins and jenkins-2-plugins is now available for OpenShiftDeveloper Tools and Services for OCP 4.13.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topic
Relevant Releases Architectures
OpenShift Developer Tools and Services for OCP 4.13 for RHEL 8 - noarch
Bugs Fixed
1856376 - CVE-2020-7692 google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization
2034388 - CVE-2021-4178 kubernetes-client: Insecure deserialization in unmarshalYaml method
2087606 - CVE-2022-22978 springframework: Authorization Bypass in RegexRequestMatcher
2134291 - CVE-2022-40152 woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks
2134292 - CVE-2022-40151 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks
2135435 - CVE-2022-42889 apache-commons-text: variable interpolation RCE
2164278 - CVE-2023-24422 jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin
2170039 - CVE-2023-25761 jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin
2170041 - CVE-2023-25762 jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin
2172298 - CVE-2023-24998 Apache Commons FileUpload: FileUpload DoS with excessive parts
2177630 - CVE-2023-27902 Jenkins: Workspace temporary directories accessible through directory browser
2177634 - CVE-2023-27904 Jenkins: Information disclosure through error stack traces related to agents
2177638 - CVE-2023-27900 Jenkins: Denial of Service attack
2177646 - CVE-2023-27901 Jenkins: Denial of Service attack
2185707 - CVE-2021-46877 jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode
6. JIRA issues fixed (https://issues.redhat.com/):
PITEAM-10 - Release 4.13 Jenkins agent image
PITEAM-9 - Release 4.13 Jenkins image
