RHSA-2023:1064: Critical: OpenShift Developer Tools and Services for OCP 4.12 security update
Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron.Security Fix(es): jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin (CVE-2022-43401) jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin (CVE-2022-43402) jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin (CVE-2022-43403) jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin (CVE-2022-43404) jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin (CVE-2022-43405) jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin (CVE-2022-43406) Pipeline Shared Groovy Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin (CVE-2022-29047) jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin (CVE-2022-43407) mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047) Jenkins plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin (CVE-2022-30952) jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003) jackson-databind: use of deeply nested arrays (CVE-2022-42004) jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin (CVE-2022-43408) jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin (CVE-2022-43409) jenkins-plugin/mercurial: Webhook endpoint discloses job names to unauthorized users in Mercurial Plugin (CVE-2022-43410) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What security issues does RHSA-2023:1064 address?
RHSA-2023:1064 addresses sandbox bypass vulnerabilities in the Jenkins Script Security Plugin.
How can I update to fix RHSA-2023:1064?
To fix RHSA-2023:1064, update to the recommended versions of Jenkins or its plugins as specified in the advisory.
Is my version affected by RHSA-2023:1064?
If you are using Jenkins versions prior to 2.361.4.1675702346-3.el8 or 2-plugins-4.12.1675702407-1.el8, you are affected by RHSA-2023:1064.
What is the impact of CVE-2022-43401 in RHSA-2023:1064?
CVE-2022-43401 allows attackers to bypass security restrictions, potentially leading to unauthorized access and execution of arbitrary scripts.
Where can I find more details about RHSA-2023:1064?
Detailed information regarding RHSA-2023:1064 can be found in the Red Hat security advisory.