Important: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2023-27901

A flaw was found in Jenkins. Affected versions of Jenkins use the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service...

CVE-2023-27901

creationtimestamp| type| source ---|---|--- 2023-03-11 00:27:28+00:00| seen| https://t.me/cibsecurity/59851 2025-02-28 19:27:10+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5963 2025-03-02 11:45:39+00:00| seen| Telegram/HCo7oBc9MuABAZ3fcQP6FO0F8XbROF3F21Hr1OX3zJVvqUa...

com.tikalk.hudson.plugins:notification (>=1.6, <=1.9), jenkins.plugins.elanceodesk:workplace-notifier (1.13) +6 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.566)

org.jenkins-ci.main:jenkins-core MAVEN version 1.566 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.tikalk.hudson.plugins:notification =1.6, =1.11, =1.2, =1.4.1 - org.jenkins-ci.plugins:plugi...

net.sleepymouse.jenkins.plugins:rpi-build-status (0.7), org.jenkins-ci.main:jenkins-war (1.658) +2 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.658)

org.jenkins-ci.main:jenkins-core MAVEN version 1.658 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - net.sleepymouse.jenkins.plugins:rpi-build-status 0.7 - org.jenkins-ci.main:jenkins-war 1.658 -...

org.jenkins-ci.main:jenkins-test-harness (1.572), org.jenkins-ci.main:jenkins-war (1.572) +14 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.572)

org.jenkins-ci.main:jenkins-core MAVEN version 1.572 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.572 - org.jenkins-ci.main:jenkins-war 1.572 -...

org.jenkins-ci.main:jenkins-test-harness (1.560), org.jenkins-ci.main:jenkins-war (1.560) +6 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.560)

org.jenkins-ci.main:jenkins-core MAVEN version 1.560 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.560 - org.jenkins-ci.main:jenkins-war 1.560 -...

org.jenkins-ci.main:jenkins-test-harness (1.575), org.jenkins-ci.main:jenkins-war (1.575) +2 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.575)

org.jenkins-ci.main:jenkins-core MAVEN version 1.575 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.575 - org.jenkins-ci.main:jenkins-war 1.575 -...

com.nirima.jenkins.repository:jenkins-maven-plugin (1.3), com.nirima.jenkins.repository:pom (1.3) +39 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.609.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.609.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.nirima.jenkins.repository:jenkins-maven-plugin 1.3 - com.nirima.jenkins.repository:pom 1....

com.cloudbees.jenkins.plugins:additional-identities-plugin (1.1), com.suryagaddipati.jenkins:slave-utilization-plugin (>=1.1, <=1.8) +8 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.488)

org.jenkins-ci.main:jenkins-core MAVEN version 1.488 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:additional-identities-plugin 1.1 -...

org.jenkins-ci.main:jenkins-test-harness (1.565.2), org.jenkins-ci.main:jenkins-war (1.565.2) +2 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.565.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.565.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.565.2 - org.jenkins-ci.main:jenkins-war 1.565.2 -...

org.jenkins-ci.main:jenkins-test-harness (1.589), org.jenkins-ci.main:jenkins-war (1.589) +1 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.589)

org.jenkins-ci.main:jenkins-core MAVEN version 1.589 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.589 - org.jenkins-ci.main:jenkins-war 1.589 -...

com.groupon.jenkins-ci.plugins:dotci (>=2.10.0, <=2.28.1), com.groupon.jenkins-ci.plugins:dotci-dockerpublish (>=1.0.0, <=1.0.3) +8 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.618)

org.jenkins-ci.main:jenkins-core MAVEN version 1.618 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =2.10.0, =1.0.0, =1.1.3, =1.7.2, =1.3.0, =1.0.0, =1.0, =1....

columnpack:columnpack-plugin (1.0.3), com.antelink.reporter.jenkins.plugin:antepediareporter-ci-plugin (>=1.0, <=1.6.3) +115 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.466)

org.jenkins-ci.main:jenkins-core MAVEN version 1.466 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - columnpack:columnpack-plugin 1.0.3 -...

org.jenkins-ci.main:jenkins-test-harness (1.598), org.jenkins-ci.main:jenkins-war (1.598) +3 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.598)

org.jenkins-ci.main:jenkins-core MAVEN version 1.598 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.598 - org.jenkins-ci.main:jenkins-war 1.598 -...

org.jenkins-ci.main:jenkins-test-harness (1.466.2), org.jenkins-ci.main:jenkins-war (1.466.2) +2 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.466.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.466.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.466.2 - org.jenkins-ci.main:jenkins-war 1.466.2 -...

org.jenkins-ci.main:jenkins-test-harness (1.517), org.jenkins-ci.main:jenkins-war (1.517) +5 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.517)

org.jenkins-ci.main:jenkins-core MAVEN version 1.517 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.517 - org.jenkins-ci.main:jenkins-war 1.517 -...

org.jenkins-ci.main:jenkins-test-harness (1.510), org.jenkins-ci.main:jenkins-war (1.510) +4 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.510)

org.jenkins-ci.main:jenkins-core MAVEN version 1.510 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.510 - org.jenkins-ci.main:jenkins-war 1.510 -...

com.synopsys.arc.jenkinsci.plugins:job-restrictions (>=0.1, <=0.3), com.synopsys.jenkinsci:ownership (>=0.3, <=0.4) +27 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.509.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.509.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.synopsys.arc.jenkinsci.plugins:job-restrictions =0.1, =0.3, =1.2, =1.3, =1.1, =1.4, =4.1....

org.jenkins-ci.main:jenkins-war (1.653), org.jenkins-ci.main:test (1.653) +9 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.653)

org.jenkins-ci.main:jenkins-core MAVEN version 1.653 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.653 - org.jenkins-ci.main:test 1.653 -...