SB2023051806 - OpenShift Developer Tools and Services for OCP 4.11 update for jenkins and jenkins-2-plugins
Published: May 18, 2023 Updated: March 25, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 22 secuirty vulnerabilities.
1) Origin validation error (CVE-ID: CVE-2021-26291)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to Apache Maven follows by default all repositories that are defined in a dependency’s Project Object Model (pom), including repositories accessible over HTTP protocol (e.g. without TLS encryption). A remote attacker can perform MitM attack and compromise the application.
2) Deserialization of Untrusted Data (CVE-ID: CVE-2022-1471)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data within the SnakeYaml's Constructor() class. A remote attacker can pass specially crafted yaml content to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Resource exhaustion (CVE-ID: CVE-2022-25857)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when handling YAML files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
4) OS Command Injection (CVE-ID: CVE-2022-29599)
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation when processing double-quoted strings. A remote attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
5) Cross-site request forgery (CVE-ID: CVE-2022-30953)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
6) Improper access control (CVE-ID: CVE-2022-30954)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in several HTTP endpoints. A remote user can connect to an attacker-specified HTTP server.
7) Code Injection (CVE-ID: CVE-2022-42889)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to an insecure variable interpolation when processing untrusted input. A remote attacker can send a specially crafted input and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note, the vulnerability was dubbed Text4shell.
8) Protection Mechanism Failure (CVE-ID: CVE-2022-43401)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures in the Groovy language runtime. A remote user can bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
9) Protection Mechanism Failure (CVE-ID: CVE-2022-43402)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures in the Groovy language runtime. A remote user can bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
10) Protection Mechanism Failure (CVE-ID: CVE-2022-43403)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures. A remote user can bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
11) Protection Mechanism Failure (CVE-ID: CVE-2022-43404)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures. A remote user can bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
12) Protection Mechanism Failure (CVE-ID: CVE-2022-43405)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures. A remote user can bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
13) Protection Mechanism Failure (CVE-ID: CVE-2022-43406)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures. A remote user can bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
14) Cross-site request forgery (CVE-ID: CVE-2022-43407)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote user can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
15) Cross-site request forgery (CVE-ID: CVE-2022-43408)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote user can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
16) Stored cross-site scripting (CVE-ID: CVE-2022-43409)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in build logs. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
17) Deserialization of Untrusted Data (CVE-ID: CVE-2022-45047)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data within the org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider class. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
18) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-24422)
The vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to a sandbox bypass issue. A remote user can bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
19) Stored cross-site scripting (CVE-ID: CVE-2023-25761)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to the affected plugin does not escape test case class names in JavaScript expressions. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
20) Stored cross-site scripting (CVE-ID: CVE-2023-25762)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to the affected plugin does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
21) Incorrect default permissions (CVE-ID: CVE-2023-27903)
The vulnerability allows a local user to compromise the target system.
The vulnerability exists due to the affected plugin creates the temporary file in the default temporary directory with the default permissions for newly created files. A local user can read and write the file before it is used in the build.
22) Information disclosure (CVE-ID: CVE-2023-27904)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application within error stack traces related to agents. A remote user can gain unauthorized access to sensitive information on the system.
Remediation
Install update from vendor's website.