RHSA-2024:5411 - Security Advisory

Topic

An update for OpenShift Jenkins is now available for Red Hat Product OCP Tools 4.14.
Red Hat Product Security has rated this update as having a security impact of critical.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating,
is available for each vulnerability from the CVE link(s) in the References section.

Description

Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron.

Security Fix(es):

• jenkins: Arbitrary file read vulnerability through agent connections can lead

to RCE (CVE-2024-43044)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

Affected Products

• OpenShift Developer Tools and Services 4.14 x86_64
• OpenShift Developer Tools and Services 4.14 s390x
• OpenShift Developer Tools and Services 4.14 ppc64le
• OpenShift Developer Tools and Services 4.14 aarch64

Fixes

• BZ - 2136374 - CVE-2022-43405 jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin
• BZ - 2136386 - CVE-2022-43407 jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin
• BZ - 2136388 - CVE-2022-43408 jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin
• BZ - 2145194 - CVE-2022-45047 mina-sshd: Java unsafe deserialization vulnerability
• BZ - 2303466 - CVE-2024-43044 jenkins: Arbitrary file read vulnerability through agent connections can lead to RCE
• JKNS-271 - Automate Polarion integration for smoke test
• JKNS-289 - Draft Knowledgebase article for Jenkins out of payload
• JKNS-337 - Update Jenkins README.md
• JKNS-344 - Design and Document second phase of self-verification process for Jenkins bugs/CVEs
• JKNS-345 - Remove legacy pieces of the Jenkins repositories, test, and verify
• JKNS-397 - USE_JAVA_VERSION doesn't work in ocp-tools-4/jenkins-agent-base-rhel8:v4.13.0
• JKNS-398 - [4.15] Jenkins Initial Release
• OCPBUGS-11158 - Mailer Plugin (mailer) has breaking changes in newest version
• OCPBUGS-11253 - Fix several dependabot alerts related to golang package versions
• OCPBUGS-11254 - Fix several bash related syntax issues
• OCPBUGS-11446 - Update config-file-provider to fix plugin dependency issue
• OCPBUGS-1357 - Jenkins install-plugins script does not ignore updates to locked plugin versions
• OCPBUGS-13869 - Bump Jenkins Plugins to latest version
• OCPBUGS-14111 - Update ImageStreams to use new Jenkins and Jenkins Agent Base images
• OCPBUGS-14609 - Bump Jenkins plugins to latest versions
• OCPBUGS-15646 - Update ImageStreams to use new Jenkins and Jenkins Agent Base images
• OCPBUGS-15902 - Failure in periodic-ci-openshift-jenkins-release-4.14-jenkins-ocp4.14-lp-interop-jenkins-interop-aws, 07-06-2023
• OCPBUGS-1709 - Align javax-mail-api with Jenkins Server 2.361.1
• OCPBUGS-1942 - Bump Jenkins version to 2.361.1
• OCPBUGS-2099 - Fix sshd embedded version
• OCPBUGS-2184 - Update jenkins-client, jenkins-sync and openshift-login plugin to latest versions
• OCPBUGS-2318 - Release and update client, sync and login plugins
• OCPBUGS-23438 - Failure in periodic-ci-openshift-jenkins-release-4.14-jenkins-hypershift4.14-aws-jenkins-lp-rosa-hypershift, 11-20-2023
• OCPBUGS-27388 - release-4.14 - Bump Jenkins Plugin Versions and Go Dependencies
• OCPBUGS-28961 - openshift/jenkins - replace 'coreydaley' with 'sayan-biswas' in OWNERS file
• OCPBUGS-655 - Update blueocean-autofavorite to 1.2.5
• OCPBUGS-6579 - update sample imagestreams with latest 4.11 image
• OCPBUGS-6870 - Bump Jenkins to 2.361.4
• OCPBUGS-710 - Add user coreydaley to list of approvers for openshift/jenkins
• OCPBUGS-8377 - Update Go to v1.19
• OCPBUGS-8442 - Jenkins images based on rhel8 are wrongly tagged with rhel7
• OCPTOOLS-244 - Bump Jenkins version to 2.414.3 [openshift-4.14]

CVEs

• CVE-2024-43044

References

• https://access.redhat.com/security/updates/classification/#critical