Vulnerability-Lookup

RHSA-2023_0017

Vulnerability from csaf_redhat - Published: 2023-01-12 16:49 - Updated: 2024-11-22 21:22

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update

Severity

Important

Notes

Topic: Red Hat OpenShift Container Platform release 4.8.56 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.8.56. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHBA-2023:0018 Security Fix(es): * Pipeline Shared Groovy Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin (CVE-2022-29047) * Jenkins plugin: Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Pipeline: Groovy Plugin (CVE-2022-30945) * Jenkins plugin: Mercurial SCM plugin can check out from the controller file system (CVE-2022-30948) * jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin (CVE-2022-34177) * jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client (CVE-2022-36881) * http2-server: Invalid HTTP/2 requests cause DoS (CVE-2022-2048) * Jenkins plugin: CSRF vulnerability in Script Security Plugin (CVE-2022-30946) * Jenkins plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin (CVE-2022-30952) * Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953) * Jenkins plugin: missing permission checks in Blue Ocean Plugin (CVE-2022-30954) * jenkins: Observable timing discrepancy allows determining username validity (CVE-2022-34174) * jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin (CVE-2022-34176) * jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git (CVE-2022-36882) * jenkins plugin: Lack of authentication mechanism in Git Plugin webhook (CVE-2022-36883) * jenkins plugin: Lack of authentication mechanism in Git Plugin webhook (CVE-2022-36884) * jenkins plugin: Non-constant time webhook signature comparison in GitHub Plugin (CVE-2022-36885) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2022-2048

A flaw was found in the Eclipse Jetty http2-server package. This flaw allows an attacker to cause a denial of service in the server via HTTP/2 requests.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-410 - Insufficient Resource Pool

Vendor Fix For OpenShift Container Platform 4.8 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html https://access.redhat.com/errata/RHSA-2023:0017

CVE-2022-29047

A flaw was found in the Jenkins Pipeline: Shared Groovy Libraries plugin. The Jenkins Pipeline: Shared Groovy Libraries plugin allows attackers to submit pull requests. However, the attacker cannot commit directly to the configured Source Control Management (SCM) to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even with the Pipeline configured not to trust them.

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

CVE-2022-30945

A flaw was found in Jenkins Groovy Plugin. The plugin allows pipelines to load Groovy source files. The intent is to allow Global Shared Libraries to execute without sandbox protection. The issue is that the plugin allows any Groovy source files bundled with Jenkins core and plugins to be loaded this way and their methods executed. If a suitable Groovy source file is available on the classpath of Jenkins, sandbox protections can be bypassed. No Groovy source files were found in Jenkins core or plugins that could result in attackers executing dangerous code; hence successful exploitation is considered highly unlikely.

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-693 - Protection Mechanism Failure

CVE-2022-30946

A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE-352 - Cross-Site Request Forgery (CSRF)

CVE-2022-30948

A flaw was found in the Jenkins plugin. Affected versions of the Jenkins Mercurial Plugin allow attackers who can configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system. This is accomplished by using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-435 - Improper Interaction Between Multiple Correctly-Behaving Entities

CVE-2022-30952

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-668 - Exposure of Resource to Wrong Sphere

CVE-2022-30953

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE-352 - Cross-Site Request Forgery (CSRF)

CVE-2022-30954

Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE-862 - Missing Authorization

CVE-2022-34174

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-208 - Observable Timing Discrepancy

CVE-2022-34176

A flaw was found in the JUnit Jenkins plugin. The manipulation with an unknown input leads to a Cross-site scripting vulnerability, impacting the integrity. This flaw allows an attacker to inject arbitrary HTML and script code into the website.

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-34177

A flaw was found in the Pipeline Input Step Plugin. This issue affects the code of the component Archive File Handler. The manipulation of the argument file with a malicious input leads to a directory traversal vulnerability.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2022-36881

A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks.

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-322 - Key Exchange without Entity Authentication

CVE-2022-36882

A flaw was found in the Git Jenkins plugin. The affected versions of the Git Jenkins Plugin allow attackers to trigger the builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-352 - Cross-Site Request Forgery (CSRF)

CVE-2022-36883

A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-862 - Missing Authorization

CVE-2022-36884

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

CVE-2022-36885

Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-208 - Observable Timing Discrepancy

References

URL

Category

	https://access.redhat.com/errata/RHSA-2023:0017	self
	https://access.redhat.com/security/updates/classi…	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2074855	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2103548	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2103551	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2114755	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2116840	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2116952	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2119642	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2119643	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2119644	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2119645	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2119646	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2119647	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2119653	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2119656	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2119657	external
	https://bugzilla.redhat.com/show_bug.cgi?id=2119658	external
	https://security.access.redhat.com/data/csaf/v2/a…	self
	https://access.redhat.com/security/cve/CVE-2022-2048	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2116952	external
	https://www.cve.org/CVERecord?id=CVE-2022-2048	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-2048	external
	https://github.com/eclipse/jetty.project/security…	external
	https://access.redhat.com/security/cve/CVE-2022-29047	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2074855	external
	https://www.cve.org/CVERecord?id=CVE-2022-29047	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-29047	external
	https://www.jenkins.io/security/advisory/2022-04-…	external
	https://access.redhat.com/security/cve/CVE-2022-30945	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2119642	external
	https://www.cve.org/CVERecord?id=CVE-2022-30945	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30945	external
	https://www.jenkins.io/security/advisory/2022-05-…	external
	https://access.redhat.com/security/cve/CVE-2022-30946	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2119643	external
	https://www.cve.org/CVERecord?id=CVE-2022-30946	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30946	external
	https://www.jenkins.io/security/advisory/2022-05-…	external
	https://access.redhat.com/security/cve/CVE-2022-30948	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2119644	external
	https://www.cve.org/CVERecord?id=CVE-2022-30948	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30948	external
	https://www.jenkins.io/security/advisory/2022-05-…	external
	https://access.redhat.com/security/cve/CVE-2022-30952	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2119645	external
	https://www.cve.org/CVERecord?id=CVE-2022-30952	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30952	external
	https://www.jenkins.io/security/advisory/2022-05-…	external
	https://access.redhat.com/security/cve/CVE-2022-30953	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2119646	external
	https://www.cve.org/CVERecord?id=CVE-2022-30953	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30953	external
	https://www.jenkins.io/security/advisory/2022-05-…	external
	https://access.redhat.com/security/cve/CVE-2022-30954	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2119647	external
	https://www.cve.org/CVERecord?id=CVE-2022-30954	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-30954	external
	https://access.redhat.com/security/cve/CVE-2022-34174	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2119653	external
	https://www.cve.org/CVERecord?id=CVE-2022-34174	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-34174	external
	https://www.jenkins.io/security/advisory/2022-06-…	external
	https://access.redhat.com/security/cve/CVE-2022-34176	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2103548	external
	https://www.cve.org/CVERecord?id=CVE-2022-34176	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-34176	external
	https://www.jenkins.io/security/advisory/2022-06-…	external
	https://access.redhat.com/security/cve/CVE-2022-34177	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2103551	external
	https://www.cve.org/CVERecord?id=CVE-2022-34177	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-34177	external
	https://www.jenkins.io/security/advisory/2022-06-…	external
	https://access.redhat.com/security/cve/CVE-2022-36881	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2114755	external
	https://www.cve.org/CVERecord?id=CVE-2022-36881	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-36881	external
	https://github.com/advisories/GHSA-cm7j-p8hc-97vj	external
	https://www.jenkins.io/security/advisory/2022-07-…	external
	https://access.redhat.com/security/cve/CVE-2022-36882	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2116840	external
	https://www.cve.org/CVERecord?id=CVE-2022-36882	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-36882	external
	https://www.jenkins.io/security/advisory/2022-07-…	external
	https://access.redhat.com/security/cve/CVE-2022-36883	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2119656	external
	https://www.cve.org/CVERecord?id=CVE-2022-36883	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-36883	external
	https://access.redhat.com/security/cve/CVE-2022-36884	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2119657	external
	https://www.cve.org/CVERecord?id=CVE-2022-36884	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-36884	external
	https://access.redhat.com/security/cve/CVE-2022-36885	self
	https://bugzilla.redhat.com/show_bug.cgi?id=2119658	external
	https://www.cve.org/CVERecord?id=CVE-2022-36885	external
	https://nvd.nist.gov/vuln/detail/CVE-2022-36885	external
	https://www.jenkins.io/security/advisory/2022-07-…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Container Platform release 4.8.56 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.8.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.8.56. See the following advisory for the container images for this release:\n\nhttps://access.redhat.com/errata/RHBA-2023:0018\n\nSecurity Fix(es):\n\n* Pipeline Shared Groovy Libraries: Untrusted users can modify some\nPipeline libraries in Pipeline Shared Groovy Libraries Plugin\n(CVE-2022-29047)\n* Jenkins plugin: Sandbox bypass vulnerability through implicitly\nallowlisted platform Groovy files in Pipeline: Groovy Plugin\n(CVE-2022-30945)\n* Jenkins plugin: Mercurial SCM plugin can check out from the controller\nfile system (CVE-2022-30948)\n* jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step\nPlugin (CVE-2022-34177)\n* jenkins-plugin: Man-in-the-Middle (MitM) in\norg.jenkins-ci.plugins:git-client (CVE-2022-36881)\n* http2-server: Invalid HTTP/2 requests cause DoS (CVE-2022-2048)\n* Jenkins plugin: CSRF vulnerability in Script Security Plugin\n(CVE-2022-30946)\n* Jenkins plugin: User-scoped credentials exposed to other users by\nPipeline SCM API for Blue Ocean Plugin (CVE-2022-30952)\n* Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)\n* Jenkins plugin: missing permission checks in Blue Ocean Plugin\n(CVE-2022-30954)\n* jenkins: Observable timing discrepancy allows determining username\nvalidity (CVE-2022-34174)\n* jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin\n(CVE-2022-34176)\n* jenkins-plugin: Cross-site Request Forgery (CSRF) in\norg.jenkins-ci.plugins:git (CVE-2022-36882)\n* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook\n(CVE-2022-36883)\n* jenkins plugin: Lack of authentication mechanism in Git Plugin webhook\n(CVE-2022-36884)\n* jenkins plugin: Non-constant time webhook signature comparison in GitHub\nPlugin (CVE-2022-36885)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s)\nlisted in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2023:0017",
        "url": "https://access.redhat.com/errata/RHSA-2023:0017"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2074855",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074855"
      },
      {
        "category": "external",
        "summary": "2103548",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103548"
      },
      {
        "category": "external",
        "summary": "2103551",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103551"
      },
      {
        "category": "external",
        "summary": "2114755",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2114755"
      },
      {
        "category": "external",
        "summary": "2116840",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116840"
      },
      {
        "category": "external",
        "summary": "2116952",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116952"
      },
      {
        "category": "external",
        "summary": "2119642",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119642"
      },
      {
        "category": "external",
        "summary": "2119643",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119643"
      },
      {
        "category": "external",
        "summary": "2119644",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119644"
      },
      {
        "category": "external",
        "summary": "2119645",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645"
      },
      {
        "category": "external",
        "summary": "2119646",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119646"
      },
      {
        "category": "external",
        "summary": "2119647",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119647"
      },
      {
        "category": "external",
        "summary": "2119653",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119653"
      },
      {
        "category": "external",
        "summary": "2119656",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119656"
      },
      {
        "category": "external",
        "summary": "2119657",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119657"
      },
      {
        "category": "external",
        "summary": "2119658",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119658"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0017.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update",
    "tracking": {
      "current_release_date": "2024-11-22T21:22:11+00:00",
      "generator": {
        "date": "2024-11-22T21:22:11+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2023:0017",
      "initial_release_date": "2023-01-12T16:49:54+00:00",
      "revision_history": [
        {
          "date": "2023-01-12T16:49:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2023-01-12T16:49:54+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T21:22:11+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.8",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.8",
                  "product_id": "8Base-RHOSE-4.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4.8::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jenkins-0:2.361.1.1672840472-1.el8.src",
                "product": {
                  "name": "jenkins-0:2.361.1.1672840472-1.el8.src",
                  "product_id": "jenkins-0:2.361.1.1672840472-1.el8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jenkins@2.361.1.1672840472-1.el8?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src",
                "product": {
                  "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src",
                  "product_id": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.8.1672842762-1.el8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jenkins-0:2.361.1.1672840472-1.el8.noarch",
                "product": {
                  "name": "jenkins-0:2.361.1.1672840472-1.el8.noarch",
                  "product_id": "jenkins-0:2.361.1.1672840472-1.el8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jenkins@2.361.1.1672840472-1.el8?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
                "product": {
                  "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
                  "product_id": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jenkins-2-plugins@4.8.1672842762-1.el8?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jenkins-0:2.361.1.1672840472-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.8",
          "product_id": "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch"
        },
        "product_reference": "jenkins-0:2.361.1.1672840472-1.el8.noarch",
        "relates_to_product_reference": "8Base-RHOSE-4.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jenkins-0:2.361.1.1672840472-1.el8.src as a component of Red Hat OpenShift Container Platform 4.8",
          "product_id": "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        },
        "product_reference": "jenkins-0:2.361.1.1672840472-1.el8.src",
        "relates_to_product_reference": "8Base-RHOSE-4.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch as a component of Red Hat OpenShift Container Platform 4.8",
          "product_id": "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch"
        },
        "product_reference": "jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
        "relates_to_product_reference": "8Base-RHOSE-4.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src as a component of Red Hat OpenShift Container Platform 4.8",
          "product_id": "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        },
        "product_reference": "jenkins-2-plugins-0:4.8.1672842762-1.el8.src",
        "relates_to_product_reference": "8Base-RHOSE-4.8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-2048",
      "cwe": {
        "id": "CWE-410",
        "name": "Insufficient Resource Pool"
      },
      "discovery_date": "2022-08-09T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2116952"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Eclipse Jetty http2-server package. This flaw allows an attacker to cause a denial of service in the server via HTTP/2 requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "http2-server: Invalid HTTP/2 requests cause DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-2048"
        },
        {
          "category": "external",
          "summary": "RHBZ#2116952",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116952"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2048",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-2048"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2048",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2048"
        },
        {
          "category": "external",
          "summary": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j",
          "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j"
        }
      ],
      "release_date": "2022-07-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "http2-server: Invalid HTTP/2 requests cause DoS"
    },
    {
      "cve": "CVE-2022-29047",
      "cwe": {
        "id": "CWE-288",
        "name": "Authentication Bypass Using an Alternate Path or Channel"
      },
      "discovery_date": "2022-04-13T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2074855"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Jenkins Pipeline: Shared Groovy Libraries plugin. The Jenkins Pipeline: Shared Groovy Libraries plugin allows attackers to submit pull requests. However, the attacker cannot commit directly to the configured Source Control Management (SCM) to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even with the Pipeline configured not to trust them.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-29047"
        },
        {
          "category": "external",
          "summary": "RHBZ#2074855",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074855"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-29047",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-29047"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-29047",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29047"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951",
          "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951"
        }
      ],
      "release_date": "2022-04-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin"
    },
    {
      "cve": "CVE-2022-30945",
      "cwe": {
        "id": "CWE-693",
        "name": "Protection Mechanism Failure"
      },
      "discovery_date": "2022-08-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2119642"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Jenkins Groovy Plugin. The plugin allows pipelines to load Groovy source files. The intent is to allow Global Shared Libraries to execute without sandbox protection. The issue is that the plugin allows any Groovy source files bundled with Jenkins core and plugins to be loaded this way and their methods executed. If a suitable Groovy source file is available on the classpath of Jenkins, sandbox protections can be bypassed. No Groovy source files were found in Jenkins core or plugins that could result in attackers executing dangerous code; hence successful exploitation is considered highly unlikely.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "plugin: Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Pipeline: Groovy Plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30945"
        },
        {
          "category": "external",
          "summary": "RHBZ#2119642",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119642"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30945",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30945"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30945",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30945"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359",
          "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359"
        }
      ],
      "release_date": "2022-05-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "plugin: Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Pipeline: Groovy Plugin"
    },
    {
      "cve": "CVE-2022-30946",
      "cwe": {
        "id": "CWE-352",
        "name": "Cross-Site Request Forgery (CSRF)"
      },
      "discovery_date": "2022-08-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2119643"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "plugin: CSRF vulnerability in Script Security Plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30946"
        },
        {
          "category": "external",
          "summary": "RHBZ#2119643",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119643"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30946",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30946"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30946",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30946"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116",
          "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116"
        }
      ],
      "release_date": "2022-05-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "plugin: CSRF vulnerability in Script Security Plugin"
    },
    {
      "cve": "CVE-2022-30948",
      "cwe": {
        "id": "CWE-435",
        "name": "Improper Interaction Between Multiple Correctly-Behaving Entities"
      },
      "discovery_date": "2022-08-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2119644"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Jenkins plugin. Affected versions of the Jenkins Mercurial Plugin allow attackers who can configure pipelines to check out some SCM repositories stored on the Jenkins controller\u0027s file system. This is accomplished by using local paths as SCM URLs, obtaining limited information about other projects\u0027 SCM contents.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "plugin: Mercurial SCM plugin can check out from the controller file system",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30948"
        },
        {
          "category": "external",
          "summary": "RHBZ#2119644",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119644"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30948",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30948"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30948",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30948"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478",
          "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478"
        }
      ],
      "release_date": "2022-05-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "plugin: Mercurial SCM plugin can check out from the controller file system"
    },
    {
      "cve": "CVE-2022-30952",
      "cwe": {
        "id": "CWE-668",
        "name": "Exposure of Resource to Wrong Sphere"
      },
      "discovery_date": "2022-08-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2119645"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30952"
        },
        {
          "category": "external",
          "summary": "RHBZ#2119645",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119645"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30952",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30952"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30952"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714",
          "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714"
        }
      ],
      "release_date": "2022-05-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin"
    },
    {
      "cve": "CVE-2022-30953",
      "cwe": {
        "id": "CWE-352",
        "name": "Cross-Site Request Forgery (CSRF)"
      },
      "discovery_date": "2022-08-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2119646"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "plugin: CSRF vulnerability in Blue Ocean Plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30953"
        },
        {
          "category": "external",
          "summary": "RHBZ#2119646",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119646"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30953",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30953"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30953",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30953"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502",
          "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502"
        }
      ],
      "release_date": "2022-05-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "plugin: CSRF vulnerability in Blue Ocean Plugin"
    },
    {
      "cve": "CVE-2022-30954",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2022-08-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2119647"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "plugin: missing permission checks in Blue Ocean Plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-30954"
        },
        {
          "category": "external",
          "summary": "RHBZ#2119647",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119647"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-30954",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-30954"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-30954",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30954"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502",
          "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502"
        }
      ],
      "release_date": "2022-05-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "plugin: missing permission checks in Blue Ocean Plugin"
    },
    {
      "cve": "CVE-2022-34174",
      "cwe": {
        "id": "CWE-208",
        "name": "Observable Timing Discrepancy"
      },
      "discovery_date": "2022-08-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2119653"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jenkins: Observable timing discrepancy allows determining username validity",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-34174"
        },
        {
          "category": "external",
          "summary": "RHBZ#2119653",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119653"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-34174",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-34174"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34174",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34174"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566",
          "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566"
        }
      ],
      "release_date": "2022-06-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jenkins: Observable timing discrepancy allows determining username validity"
    },
    {
      "cve": "CVE-2022-34176",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2022-07-04T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2103548"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the JUnit Jenkins plugin. The manipulation with an unknown input leads to a Cross-site scripting vulnerability, impacting the integrity. This flaw allows an attacker to inject arbitrary HTML and script code into the website.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-34176"
        },
        {
          "category": "external",
          "summary": "RHBZ#2103548",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103548"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-34176",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-34176"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34176",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34176"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760",
          "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760"
        }
      ],
      "release_date": "2022-06-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin"
    },
    {
      "cve": "CVE-2022-34177",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2022-07-04T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2103551"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Pipeline Input Step Plugin. This issue affects the code of the component Archive File Handler. The manipulation of the argument file with a malicious input leads to a directory traversal vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-34177"
        },
        {
          "category": "external",
          "summary": "RHBZ#2103551",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103551"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-34177",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-34177"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-34177",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34177"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2705",
          "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2705"
        }
      ],
      "release_date": "2022-06-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin"
    },
    {
      "cve": "CVE-2022-36881",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "discovery_date": "2022-08-03T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2114755"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-36881"
        },
        {
          "category": "external",
          "summary": "RHBZ#2114755",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2114755"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36881",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-36881"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36881",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36881"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-cm7j-p8hc-97vj",
          "url": "https://github.com/advisories/GHSA-cm7j-p8hc-97vj"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468",
          "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468"
        }
      ],
      "release_date": "2022-08-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client"
    },
    {
      "cve": "CVE-2022-36882",
      "cwe": {
        "id": "CWE-352",
        "name": "Cross-Site Request Forgery (CSRF)"
      },
      "discovery_date": "2022-08-09T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2116840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Git Jenkins plugin. The affected versions of the Git Jenkins Plugin allow attackers to trigger the builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-36882"
        },
        {
          "category": "external",
          "summary": "RHBZ#2116840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36882",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-36882"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36882",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36882"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284",
          "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"
        }
      ],
      "release_date": "2022-08-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git"
    },
    {
      "cve": "CVE-2022-36883",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2022-08-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2119656"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "plugin: Lack of authentication mechanism in Git Plugin webhook",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-36883"
        },
        {
          "category": "external",
          "summary": "RHBZ#2119656",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119656"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36883",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-36883"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36883",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36883"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284",
          "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"
        }
      ],
      "release_date": "2022-07-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "plugin: Lack of authentication mechanism in Git Plugin webhook"
    },
    {
      "cve": "CVE-2022-36884",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2022-08-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2119657"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "plugin: Lack of authentication mechanism in Git Plugin webhook",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-36884"
        },
        {
          "category": "external",
          "summary": "RHBZ#2119657",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119657"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36884",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-36884"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36884",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36884"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284",
          "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"
        }
      ],
      "release_date": "2022-07-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "plugin: Lack of authentication mechanism in Git Plugin webhook"
    },
    {
      "cve": "CVE-2022-36885",
      "cwe": {
        "id": "CWE-208",
        "name": "Observable Timing Discrepancy"
      },
      "discovery_date": "2022-08-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2119658"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "plugin: Non-constant time webhook signature comparison in GitHub Plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
        ],
        "known_not_affected": [
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.noarch",
          "8Base-RHOSE-4.8:jenkins-0:2.361.1.1672840472-1.el8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-36885"
        },
        {
          "category": "external",
          "summary": "RHBZ#2119658",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2119658"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-36885",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-36885"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885"
        },
        {
          "category": "external",
          "summary": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849",
          "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849"
        }
      ],
      "release_date": "2022-07-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-01-12T16:49:54+00:00",
          "details": "For OpenShift Container Platform 4.8 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html",
          "product_ids": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2023:0017"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.noarch",
            "8Base-RHOSE-4.8:jenkins-2-plugins-0:4.8.1672842762-1.el8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "plugin: Non-constant time webhook signature comparison in GitHub Plugin"
    }
  ]
}

CVE-2022-36881 (GCVE-0-2022-36881)

Vulnerability from cvelistv5 – Published: 2022-07-27 14:20 – Updated: 2024-08-03 10:14

Summary

Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks.

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

	https://www.jenkins.io/security/advisory/2022-07-…	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/07/27/1	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins Git client Plugin	Affected: unspecified , ≤ 3.11.0 (custom) Unaffected: 3.10.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:14:29.073Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468"
          },
          {
            "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Git client Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "3.11.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "3.10.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:23:53.879Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468"
        },
        {
          "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2022-36881",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins Git client Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "3.11.0"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "3.10.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-322: Key Exchange without Entity Authentication"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468",
              "refsource": "CONFIRM",
              "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1468"
            },
            {
              "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-36881",
    "datePublished": "2022-07-27T14:20:49.000Z",
    "dateReserved": "2022-07-27T00:00:00.000Z",
    "dateUpdated": "2024-08-03T10:14:29.073Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-30952 (GCVE-0-2022-30952)

Vulnerability from cvelistv5 – Published: 2022-05-17 00:00 – Updated: 2024-08-03 07:03

Summary

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

	https://www.jenkins.io/security/advisory/2022-05-…
	http://www.openwall.com/lists/oss-security/2022/05/17/8	mailing-list

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins Pipeline SCM API for Blue Ocean Plugin	Affected: unspecified , ≤ 1.25.3 (custom) Unaffected: 1.25.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:03:39.865Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714"
          },
          {
            "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Pipeline SCM API for Blue Ocean Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "1.25.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "1.25.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:21:47.422Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-714"
        },
        {
          "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-30952",
    "datePublished": "2022-05-17T00:00:00.000Z",
    "dateReserved": "2022-05-16T00:00:00.000Z",
    "dateUpdated": "2024-08-03T07:03:39.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-30953 (GCVE-0-2022-30953)

Vulnerability from cvelistv5 – Published: 2022-05-17 14:06 – Updated: 2024-08-03 07:03

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server.

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

	https://www.jenkins.io/security/advisory/2022-05-…	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/05/17/8	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins Blue Ocean Plugin	Affected: unspecified , ≤ 1.25.3 (custom) Unaffected: 1.25.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:03:39.866Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502"
          },
          {
            "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Blue Ocean Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "1.25.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "1.25.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:21:48.605Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502"
        },
        {
          "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2022-30953",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins Blue Ocean Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "1.25.3"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "1.25.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352: Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502",
              "refsource": "CONFIRM",
              "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502"
            },
            {
              "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-30953",
    "datePublished": "2022-05-17T14:06:18.000Z",
    "dateReserved": "2022-05-16T00:00:00.000Z",
    "dateUpdated": "2024-08-03T07:03:39.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-36885 (GCVE-0-2022-36885)

Vulnerability from cvelistv5 – Published: 2022-07-27 14:21 – Updated: 2024-08-03 10:14

Summary

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

	https://www.jenkins.io/security/advisory/2022-07-…	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/07/27/1	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins GitHub Plugin	Affected: unspecified , ≤ 1.34.4 (custom) Unaffected: 1.34.3.1 Unaffected: 1.34.1.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:14:29.453Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849"
          },
          {
            "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins GitHub Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "1.34.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "1.34.3.1"
            },
            {
              "status": "unaffected",
              "version": "1.34.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:23:58.571Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849"
        },
        {
          "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2022-36885",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins GitHub Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "1.34.4"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "1.34.3.1"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "1.34.1.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-208: Observable Timing Discrepancy"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849",
              "refsource": "CONFIRM",
              "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-1849"
            },
            {
              "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-36885",
    "datePublished": "2022-07-27T14:21:38.000Z",
    "dateReserved": "2022-07-27T00:00:00.000Z",
    "dateUpdated": "2024-08-03T10:14:29.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-30945 (GCVE-0-2022-30945)

Vulnerability from cvelistv5 – Published: 2022-05-17 14:05 – Updated: 2024-08-03 07:03

Summary

Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines.

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

	https://www.jenkins.io/security/advisory/2022-05-…	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/05/17/8	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins Pipeline: Groovy Plugin	Affected: unspecified , ≤ 2689.v434009a_31b_f1 (custom) Unaffected: 2683.2687.vb_0cc3f973f06 Unaffected: 2.94.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:03:40.031Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359"
          },
          {
            "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Pipeline: Groovy Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "2689.v434009a_31b_f1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2683.2687.vb_0cc3f973f06"
            },
            {
              "status": "unaffected",
              "version": "2.94.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:21:39.109Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359"
        },
        {
          "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2022-30945",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins Pipeline: Groovy Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2689.v434009a_31b_f1"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "2683.2687.vb_0cc3f973f06"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "2.94.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-693: Protection Mechanism Failure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359",
              "refsource": "CONFIRM",
              "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359"
            },
            {
              "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-30945",
    "datePublished": "2022-05-17T14:05:37.000Z",
    "dateReserved": "2022-05-16T00:00:00.000Z",
    "dateUpdated": "2024-08-03T07:03:40.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-34174 (GCVE-0-2022-34174)

Vulnerability from cvelistv5 – Published: 2022-06-22 14:40 – Updated: 2024-08-03 08:16

Summary

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

https://www.jenkins.io/security/advisory/2022-06-…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins	Affected: unspecified , ≤ 2.355 (custom) Affected: unspecified , ≤ LTS 2.332.3 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:16:17.136Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "2.355",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "LTS 2.332.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:22:17.030Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2022-34174",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2.355"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "LTS 2.332.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-208: Observable Timing Discrepancy"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566",
              "refsource": "CONFIRM",
              "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-34174",
    "datePublished": "2022-06-22T14:40:56.000Z",
    "dateReserved": "2022-06-21T00:00:00.000Z",
    "dateUpdated": "2024-08-03T08:16:17.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-34177 (GCVE-0-2022-34177)

Vulnerability from cvelistv5 – Published: 2022-06-22 00:00 – Updated: 2024-08-03 08:16

Summary

Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

https://www.jenkins.io/security/advisory/2022-06-…

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins Pipeline: Input Step Plugin	Unaffected: 447.449.v193fd29f6021 Unaffected: 2.12.2 Affected: unspecified , ≤ 448.v37cea_9a_10a_70 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:16:17.208Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2705"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Pipeline: Input Step Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "status": "unaffected",
              "version": "447.449.v193fd29f6021"
            },
            {
              "status": "unaffected",
              "version": "2.12.2"
            },
            {
              "lessThanOrEqual": "448.v37cea_9a_10a_70",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:22:20.551Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2705"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-34177",
    "datePublished": "2022-06-22T00:00:00.000Z",
    "dateReserved": "2022-06-21T00:00:00.000Z",
    "dateUpdated": "2024-08-03T08:16:17.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-36883 (GCVE-0-2022-36883)

Vulnerability from cvelistv5 – Published: 2022-07-27 14:21 – Updated: 2024-08-03 10:14

Summary

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

	https://www.jenkins.io/security/advisory/2022-07-…	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/07/27/1	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins Git Plugin	Affected: unspecified , ≤ 4.11.3 (custom) Unaffected: 4.9.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:14:28.862Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"
          },
          {
            "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Git Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "4.11.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "4.9.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:23:56.257Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"
        },
        {
          "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2022-36883",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins Git Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "4.11.3"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "4.9.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-862: Missing Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284",
              "refsource": "CONFIRM",
              "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"
            },
            {
              "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-36883",
    "datePublished": "2022-07-27T14:21:12.000Z",
    "dateReserved": "2022-07-27T00:00:00.000Z",
    "dateUpdated": "2024-08-03T10:14:28.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-2048 (GCVE-0-2022-2048)

Vulnerability from cvelistv5 – Published: 2022-07-07 20:35 – Updated: 2024-08-03 00:24

Summary

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

Assigner

eclipse

References

URL

Tags

	https://github.com/eclipse/jetty.project/security…	x_refsource_CONFIRM
	https://www.debian.org/security/2022/dsa-5198	vendor-advisoryx_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2022…	mailing-listx_refsource_MLIST
	https://security.netapp.com/advisory/ntap-2022090…	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/09/09/2	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	The Eclipse Foundation	Eclipse Jetty	Affected: 9.4.0 , < unspecified (custom) Affected: unspecified , ≤ 9.4.46 (custom) Affected: 10.0.0 , < unspecified (custom) Affected: unspecified , ≤ 10.0.9 (custom) Affected: 11.0.0 , < unspecified (custom) Affected: unspecified , ≤ 11.0.9 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:24:43.964Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j"
          },
          {
            "name": "DSA-5198",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5198"
          },
          {
            "name": "[debian-lts-announce] 20220821 [SECURITY] [DLA 3079-1] jetty9 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220901-0006/"
          },
          {
            "name": "[oss-security] 20220909 Vulnerability in Jenkins",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/09/09/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Eclipse Jetty",
          "vendor": "The Eclipse Foundation",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "9.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "9.4.46",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "10.0.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "11.0.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-410",
              "description": "CWE-410",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-664",
              "description": "CWE-664",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-09T14:06:11.000Z",
        "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
        "shortName": "eclipse"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j"
        },
        {
          "name": "DSA-5198",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5198"
        },
        {
          "name": "[debian-lts-announce] 20220821 [SECURITY] [DLA 3079-1] jetty9 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220901-0006/"
        },
        {
          "name": "[oss-security] 20220909 Vulnerability in Jenkins",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/09/09/2"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@eclipse.org",
          "ID": "CVE-2022-2048",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Eclipse Jetty",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "9.4.0"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "9.4.46"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "10.0.0"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "10.0.9"
                          },
                          {
                            "version_affected": "\u003e=",
                            "version_value": "11.0.0"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "11.0.9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "The Eclipse Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-410"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-664"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j",
              "refsource": "CONFIRM",
              "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j"
            },
            {
              "name": "DSA-5198",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5198"
            },
            {
              "name": "[debian-lts-announce] 20220821 [SECURITY] [DLA 3079-1] jetty9 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220901-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220901-0006/"
            },
            {
              "name": "[oss-security] 20220909 Vulnerability in Jenkins",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/09/09/2"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
    "assignerShortName": "eclipse",
    "cveId": "CVE-2022-2048",
    "datePublished": "2022-07-07T20:35:09.000Z",
    "dateReserved": "2022-06-09T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:24:43.964Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-29047 (GCVE-0-2022-29047)

Vulnerability from cvelistv5 – Published: 2022-04-12 19:50 – Updated: 2024-11-20 15:35

Summary

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

https://www.jenkins.io/security/advisory/2022-04-…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins Pipeline: Shared Groovy Libraries Plugin	Affected: unspecified , ≤ 564.ve62a_4eb_b_e039 (custom) Unaffected: 2.21.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:10:58.673Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-29047",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-03T19:16:45.537224Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-20T15:35:52.801Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Pipeline: Shared Groovy Libraries Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "564.ve62a_4eb_b_e039",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2.21.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:21:32.061Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2022-29047",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins Pipeline: Shared Groovy Libraries Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "564.ve62a_4eb_b_e039"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "2.21.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-693: Protection Mechanism Failure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951",
              "refsource": "CONFIRM",
              "url": "https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-29047",
    "datePublished": "2022-04-12T19:50:46.000Z",
    "dateReserved": "2022-04-11T00:00:00.000Z",
    "dateUpdated": "2024-11-20T15:35:52.801Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-30954 (GCVE-0-2022-30954)

Vulnerability from cvelistv5 – Published: 2022-05-17 14:06 – Updated: 2024-08-03 07:03

Summary

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

	https://www.jenkins.io/security/advisory/2022-05-…	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/05/17/8	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins Blue Ocean Plugin	Affected: unspecified , ≤ 1.25.3 (custom) Unaffected: 1.25.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:03:40.035Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502"
          },
          {
            "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Blue Ocean Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "1.25.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "1.25.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:21:49.823Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502"
        },
        {
          "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2022-30954",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins Blue Ocean Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "1.25.3"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "1.25.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-862: Missing Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502",
              "refsource": "CONFIRM",
              "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502"
            },
            {
              "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-30954",
    "datePublished": "2022-05-17T14:06:21.000Z",
    "dateReserved": "2022-05-16T00:00:00.000Z",
    "dateUpdated": "2024-08-03T07:03:40.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-36884 (GCVE-0-2022-36884)

Vulnerability from cvelistv5 – Published: 2022-07-27 14:21 – Updated: 2024-08-03 10:14

Summary

The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository.

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

	https://www.jenkins.io/security/advisory/2022-07-…	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/07/27/1	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins Git Plugin	Affected: unspecified , ≤ 4.11.3 (custom) Unaffected: 4.9.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:14:29.343Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"
          },
          {
            "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Git Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "4.11.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "4.9.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:23:57.408Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"
        },
        {
          "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2022-36884",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins Git Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "4.11.3"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "4.9.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an attacker-specified Git repository."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284",
              "refsource": "CONFIRM",
              "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"
            },
            {
              "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-36884",
    "datePublished": "2022-07-27T14:21:25.000Z",
    "dateReserved": "2022-07-27T00:00:00.000Z",
    "dateUpdated": "2024-08-03T10:14:29.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-36882 (GCVE-0-2022-36882)

Vulnerability from cvelistv5 – Published: 2022-07-27 14:20 – Updated: 2024-08-03 10:14

Summary

A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

	https://www.jenkins.io/security/advisory/2022-07-…	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/07/27/1	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins Git Plugin	Affected: unspecified , ≤ 4.11.3 (custom) Unaffected: 4.9.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:14:29.407Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"
          },
          {
            "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Git Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "4.11.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "4.9.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:23:55.063Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"
        },
        {
          "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2022-36882",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins Git Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "4.11.3"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "4.9.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352: Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284",
              "refsource": "CONFIRM",
              "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-284"
            },
            {
              "name": "[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-36882",
    "datePublished": "2022-07-27T14:20:59.000Z",
    "dateReserved": "2022-07-27T00:00:00.000Z",
    "dateUpdated": "2024-08-03T10:14:29.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-30948 (GCVE-0-2022-30948)

Vulnerability from cvelistv5 – Published: 2022-05-17 14:06 – Updated: 2024-08-03 07:03

Summary

Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

	https://www.jenkins.io/security/advisory/2022-05-…	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/05/17/8	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins Mercurial Plugin	Affected: unspecified , ≤ 2.16 (custom) Unaffected: 2.15.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:03:39.392Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478"
          },
          {
            "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Mercurial Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "2.16",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2.15.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller\u0027s file system using local paths as SCM URLs, obtaining limited information about other projects\u0027 SCM contents."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:21:42.671Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478"
        },
        {
          "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2022-30948",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins Mercurial Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2.16"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "2.15.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller\u0027s file system using local paths as SCM URLs, obtaining limited information about other projects\u0027 SCM contents."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-435: Improper Interaction Between Multiple Correctly-Behaving Entities"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478",
              "refsource": "CONFIRM",
              "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2478"
            },
            {
              "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-30948",
    "datePublished": "2022-05-17T14:06:07.000Z",
    "dateReserved": "2022-05-16T00:00:00.000Z",
    "dateUpdated": "2024-08-03T07:03:39.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-34176 (GCVE-0-2022-34176)

Vulnerability from cvelistv5 – Published: 2022-06-22 00:00 – Updated: 2024-08-03 08:16

Summary

Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

https://www.jenkins.io/security/advisory/2022-06-…

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins JUnit Plugin	Unaffected: 1.53.0.1 Affected: unspecified , ≤ 1119.va_a_5e9068da_d7 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:16:17.216Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins JUnit Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.53.0.1"
            },
            {
              "lessThanOrEqual": "1119.va_a_5e9068da_d7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:22:19.354Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "url": "https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2760"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-34176",
    "datePublished": "2022-06-22T00:00:00.000Z",
    "dateReserved": "2022-06-21T00:00:00.000Z",
    "dateUpdated": "2024-08-03T08:16:17.216Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-30946 (GCVE-0-2022-30946)

Vulnerability from cvelistv5 – Published: 2022-05-17 14:05 – Updated: 2024-08-03 07:03

Summary

Severity ?

No CVSS data available.

Assigner

jenkins

References

URL

Tags

	https://www.jenkins.io/security/advisory/2022-05-…	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2022/05/17/8	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Jenkins project	Jenkins Script Security Plugin	Affected: unspecified , ≤ 1158.v7c1b_73a_69a_08 (custom) Unaffected: 1.78.1 Unaffected: 1145.1148.vf6d17a_a_a_eef6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:03:39.447Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116"
          },
          {
            "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jenkins Script Security Plugin",
          "vendor": "Jenkins project",
          "versions": [
            {
              "lessThanOrEqual": "1158.v7c1b_73a_69a_08",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "1.78.1"
            },
            {
              "status": "unaffected",
              "version": "1145.1148.vf6d17a_a_a_eef6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-24T14:21:40.293Z",
        "orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
        "shortName": "jenkins"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116"
        },
        {
          "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "jenkinsci-cert@googlegroups.com",
          "ID": "CVE-2022-30946",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jenkins Script Security Plugin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "1158.v7c1b_73a_69a_08"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "1.78.1"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "1145.1148.vf6d17a_a_a_eef6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Jenkins project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352: Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116",
              "refsource": "CONFIRM",
              "url": "https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2116"
            },
            {
              "name": "[oss-security] 20220517 Multiple vulnerabilities in Jenkins plugins",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/05/17/8"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
    "assignerShortName": "jenkins",
    "cveId": "CVE-2022-30946",
    "datePublished": "2022-05-17T14:05:52.000Z",
    "dateReserved": "2022-05-16T00:00:00.000Z",
    "dateUpdated": "2024-08-03T07:03:39.447Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2023_0017

CVE-2022-36881 (GCVE-0-2022-36881)

CVE-2022-30952 (GCVE-0-2022-30952)

CVE-2022-30953 (GCVE-0-2022-30953)

CVE-2022-36885 (GCVE-0-2022-36885)

CVE-2022-30945 (GCVE-0-2022-30945)

CVE-2022-34174 (GCVE-0-2022-34174)

CVE-2022-34177 (GCVE-0-2022-34177)

CVE-2022-36883 (GCVE-0-2022-36883)

CVE-2022-2048 (GCVE-0-2022-2048)

CVE-2022-29047 (GCVE-0-2022-29047)

CVE-2022-30954 (GCVE-0-2022-30954)

CVE-2022-36884 (GCVE-0-2022-36884)

CVE-2022-36882 (GCVE-0-2022-36882)

CVE-2022-30948 (GCVE-0-2022-30948)

CVE-2022-34176 (GCVE-0-2022-34176)

CVE-2022-30946 (GCVE-0-2022-30946)

Tags

Sightings

Nomenclature