Jenkins Enterprise and Operations Center 2.303.x < 2.303.30.0.16 / 2.346.4.1 Multiple Vulnerabilities (CloudBees Security Advisory 2022-08-27)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.303.x prior to 2.303.30.0.16, or 2.x prior to 2.346.4.1. It is, therefore, affected by multiple vulnerabilities, including the following: - Loading specially-crafted yaml with the Kubernetes Java...

org.jenkins-ci.plugins:github-branch-source (>=0.1-beta-1, <=1.10.1), org.jenkins-ci.plugins:github-organization-folder (>=1.0-beta-1, <=1.5) +2 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.3)

org.jenkins-ci.plugins:git MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:github-branch-source =0.1-beta-1, =1.0-beta-1, =1.0, =1.0.0, =1.0.3 Source cves:...

io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45), org.jenkins-ci.plugins:github-oauth (>=0.25, <=0.33) +1 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (3.0.0)

org.jenkins-ci.plugins:git MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =y, =0.25, =0.33 - org.jenkins-ci.plugins:stash-pullrequest-build...

org.jenkins-ci.plugins:stashnotifier (1.16) potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (4.0.0-rc)

org.jenkins-ci.plugins:git MAVEN version 4.0.0-rc is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:stashnotifier 1.16 Source cves: CVE-2022-38663 Source advisory: GHSA-JXMW-3GXF-FP...

de.wellnerbou.jenkins:git-changelog (>=3.0, <=3.31), org.jenkins-ci.plugins:bitbucket (>=1.1.2, <=1.1.13) +4 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.3.5)

org.jenkins-ci.plugins:git MAVEN version 2.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - de.wellnerbou.jenkins:git-changelog =3.0, =1.1.2, =1.3, =0.1, =1.0.0, =1.6.8, =1.6.11 Source cves:...

br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1), org.jenkins-ci.plugins:gitlab-oauth (>=1.0.3, <=1.0.9) +1 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.4.4)

org.jenkins-ci.plugins:git MAVEN version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - br.com.ingenieux.jenkins.plugins:codecommit-url-helper 0.0.1 - org.jenkins-ci.plugins:gitlab-oauth =1.0.3,...

com.dabsquared:gitlab-plugin (1.0.5), org.jenkins-ci.plugins:gitbucket (>=0.5.1, <=0.7) +1 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.2.1)

org.jenkins-ci.plugins:git MAVEN version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - com.dabsquared:gitlab-plugin 1.0.5 - org.jenkins-ci.plugins:gitbucket =0.5.1, =1.0.7, =1.1.3 Source cves:...

com.coravy.hudson.plugins.github:github (>=1.9, <=1.13.3), com.elasticbox.jenkins-ci.plugins:elasticbox (>=4.0.9, <=4.1.0) +4 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.0)

org.jenkins-ci.plugins:git MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - com.coravy.hudson.plugins.github:github =1.9, =4.0.9, =0.9.14, =1.8, =1.4.0, =1.4.2 Source cves: CVE-2022-386...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=0.1-beta-1, <=0.1-beta-4), org.jenkins-ci.plugins.workflow:workflow-scm-step (>=0.1-beta-1, <=0.1-beta-4) potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.3-beta-1)

org.jenkins-ci.plugins:git MAVEN version 2.3-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator =0.1-beta-1, =0.1-beta-1, =0.1-beta-4 Source cves:...

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (>=2.2.3, <=2.2.10), org.jenkins-ci.plugins:gitea (>=1.0.1, <=1.1.2) +1 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (3.5.0)

org.jenkins-ci.plugins:git MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source =2.2.3, =1.0.1, =2.2.3, =2.2.6 Source cves:...

org.jenkins-ci.plugins:git-bisect (>=1.0, <=1.3) potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.6.0)

org.jenkins-ci.plugins:git MAVEN version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:git-bisect =1.0, =1.3 Source cves: CVE-2022-38663 Source advisory:...

com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger (>=2.8.0, <=2.10.1) potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (1.2.0)

org.jenkins-ci.plugins:git MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger =2.8.0, =2.10.1 Source cves: CVE-2022-38663 Source...

org.jenkins-ci.plugins:bitbucket-approval-filter (1.0.0), org.jenkins-ci.plugins:bitbucket-filter-project-trait (1.0) +7 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (3.6.0)

org.jenkins-ci.plugins:git MAVEN version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:bitbucket-approval-filter 1.0.0 -...

com.groupon.jenkins-ci.plugins:dotci (>=1.1.0, <=2.27.0), com.groupon.jenkins-ci.plugins:dotci-dockerpublish (>=1.0.0, <=1.0.3) +7 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.0.3)

org.jenkins-ci.plugins:git MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =1.1.0, =1.0.0, =1.0.1, =1.1.3, =1.7.2, =1.1.0, =1.0.0, =1.0, =0.16,...

org.jenkins-ci.plugins:git-parameter (0.3.2), org.jenkins-ci.plugins:pretested-integration (>=2.0, <=2.3.3) potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.2.0)

org.jenkins-ci.plugins:git MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:git-parameter 0.3.2 - org.jenkins-ci.plugins:pretested-integration =2.0, =2.3.3 Sour...

com.coravy.hudson.plugins.github:github (>=1.14.0-alpha-1, <=1.27.0), com.elasticbox.jenkins-ci.plugins:elasticbox (>=4.1.1, <=4.1.6) +12 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.4.0)

org.jenkins-ci.plugins:git MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - com.coravy.hudson.plugins.github:github =1.14.0-alpha-1, =4.1.1, =1.0.0, =1.0, =1.1.0, =1.33.2, =1.0,...

org.jenkins-ci.plugins:git-tag-message (>=1.0, <=1.5) potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.2.7)

org.jenkins-ci.plugins:git MAVEN version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:git-tag-message =1.0, =1.5 Source cves: CVE-2022-38663 Source advisory:...

org.jenkins-ci.plugins:stashnotifier (1.16) potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (4.0.0-rc)

org.jenkins-ci.plugins:git MAVEN version 4.0.0-rc is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - org.jenkins-ci.plugins:stashnotifier 1.16 Source cves: CVE-2022-38663 Source advisory:...

com.coravy.hudson.plugins.github:github (>=1.28.0, <=1.29.4), io.jenkins.blueocean:blueocean-git-pipeline (>=1.2.0-beta-3, <=1.2.0-beta-4) +5 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (3.4.0)

org.jenkins-ci.plugins:git MAVEN version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - com.coravy.hudson.plugins.github:github =1.28.0, =1.2.0-beta-3, =2.2.0, =1.0, =2.2.0, =2.2.2 -...

io.jenkins.plugins:hugo (0.1.3) potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (3.9.0)

org.jenkins-ci.plugins:git MAVEN version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - io.jenkins.plugins:hugo 0.1.3 Source cves: CVE-2022-38663 Source advisory: OSV:GHSA-JXMW-3GXF-FPRH...