Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.4
Jenkins in OpenShift OCP 4.13 Allows Unauthorized Access
published 1 year ago
Summary
A security update is available for Jenkins in OpenShift OCP 4.13, which could allow an attacker to access sensitive information or execute unauthorized actions. This affects OpenShift clusters with Jenkins installed. To stay secure, apply the latest update as soon as possible.
What to do
- Update redhat jenkins to version 0:2.462.3.1729839924-3.el8.
- Update redhat jenkins-2-plugins to version 0:4.13.1729840148-1.el8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:ocp_tools:4.13::el8 | redhat | jenkins |
< 0:2.462.3.1729839924-3.el8 Fix: upgrade to 0:2.462.3.1729839924-3.el8
|
| Red Hat:ocp_tools:4.13::el8 | redhat | jenkins-2-plugins |
< 0:4.13.1729840148-1.el8 Fix: upgrade to 0:4.13.1729840148-1.el8
|
Original advisory text
Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 Openshift Jenkins security update
References
- https://access.redhat.com/errata/RHSA-2024:8887 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8887.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2021-44549 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2315808 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-44549 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-44549 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-38808 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2305959 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-38808 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-38808 Vendor Advisory
- https://spring.io/security/cve-2024-38808 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-47803 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2316137 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-47803 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-47803 Vendor Advisory
- https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3451 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-47804 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2316131 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-47804 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-47804 Vendor Advisory
- https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3448 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published15 Nov 2024
Updated22 Mar 2026
First seen22 Mar 2026
Sources
RHSA-2024:8887 · OSV
Track software like this
Free during beta