Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Jenkins and Jenkins Plugins: Unauthenticated Code Execution Risk

published 2 years ago

Summary

Jenkins and its plugins have security updates to prevent unauthorized code execution. This update is important for any business using Jenkins, as it protects against potential attacks that could allow hackers to run malicious code on a server. Update your Jenkins installation and plugins to the latest versions to ensure security.

What to do

Update redhat jenkins to version 0:2.401.1.1686649641-3.el8.
Update redhat jenkins-2-plugins to version 0:4.12.1686649756-1.el8.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:ocp_tools:4.12::el8	redhat	jenkins	< 0:2.401.1.1686649641-3.el8 Fix: upgrade to 0:2.401.1.1686649641-3.el8
Red Hat:ocp_tools:4.12::el8	redhat	jenkins-2-plugins	< 0:4.12.1686649756-1.el8 Fix: upgrade to 0:4.12.1686649756-1.el8

Original advisory text

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

References

https://access.redhat.com/errata/RHSA-2023:3610 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2066479 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2119646 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2119647 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2135770 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2135771 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2155970 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2164278 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2178358 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2180528 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2180530 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2185707 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2188542 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2207830 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2207835 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3610.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-46877 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-46877 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-46877 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-29599 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-29599 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-29599 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-30953 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-30953 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-30953 Vendor Advisory
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-30954 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-30954 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-30954 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-40149 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-40149 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-40149 Vendor Advisory
https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-40150 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-40150 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-40150 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-45693 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-45693 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-45693 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-1370 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-1370 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-1370 Vendor Advisory
https://github.com/advisories/GHSA-493p-pfq6-5258 Vendor Advisory
https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-... Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-20860 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-20860 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-20860 Vendor Advisory
https://spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023... Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-20861 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-20861 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-20861 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-24422 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-24422 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-24422 Vendor Advisory
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-3016 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-32977 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-32977 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-32977 Vendor Advisory
https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3042 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-32981 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-32981 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-32981 Vendor Advisory
https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2196 Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Timeline

Published30 Sep 2024

Updated25 Apr 2026

First seen25 Apr 2026

Sources

RHSA-2023:3610 · OSV

Track software like this

Free during beta