Important: Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 Openshift Jenkins security update

An update for Openshift Jenkins is now available for Red Hat Product OCP Tools 4.13. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

org.jenkins-ci.plugins:gradle (>=1.37.1, <=1.40) potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1.64)

org.jenkins-ci.plugins:script-security MAVEN version 1.64 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:gradle =1.37.1, =1.40 Source cves: CVE-2024-52549 Source...

de.esailors.jenkins:test-stability (2.4), io.jenkins.blueocean:blueocean-rest-impl (>=1.27.17, <=1.27.18) +20 more potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1335.vf07d9ce377a_e)

org.jenkins-ci.plugins:script-security MAVEN version 1335.vf07d9ce377ae is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - de.esailors.jenkins:test-stability 2.4 -...

org.jenkins-ci.plugins:pipeline-utility-steps (>=1.4.0, <=1.5.1) potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1.29.1)

org.jenkins-ci.plugins:script-security MAVEN version 1.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:pipeline-utility-steps =1.4.0, =1.5.1 Source cves:...

org.jenkins-ci.plugins:groovy (2.1) potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1.50)

org.jenkins-ci.plugins:script-security MAVEN version 1.50 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:groovy 2.1 Source cves: CVE-2024-52549 Source advisory:...

org.6wind.jenkins:lockable-resources (>=1309.ve21874387edf, <=1310.v99ca_947ed698), org.jenkins-ci.plugins:badge (>=2.0, <=2.1) +5 more potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1361.v913100720139)

org.jenkins-ci.plugins:script-security MAVEN version 1361.v913100720139 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.6wind.jenkins:lockable-resources =1309.ve21874387edf, =2.0, =5.5.0...

au.com.versent.jenkins.plugins:ignore-committer-strategy (29.v7c3891a_434c3), com.coravy.hudson.plugins.github:github (>=1.41.0, <=1.42.0) +52 more potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1362.v67dc1f0e1b_b_3)

org.jenkins-ci.plugins:script-security MAVEN version 1362.v67dc1f0e1bb3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - au.com.versent.jenkins.plugins:ignore-committer-strategy...

com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2), de.taimos:pipeline-aws (>=1.0, <=1.20) +22 more potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1.24)

org.jenkins-ci.plugins:script-security MAVEN version 1.24 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.logmein:pipeline-bamboo =0.0.1, =1.0, =y, =1.0.0-b22, =1.0.0-b22, =1.0.0-b22,...

io.jenkins.blueocean:blueocean (>=1.0.0-b18, <=1.0.0-b21), io.jenkins.blueocean:blueocean-dashboard (>=1.0.0-b18, <=1.0.0-b21) +13 more potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1.23)

org.jenkins-ci.plugins:script-security MAVEN version 1.23 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.blueocean:blueocean =1.0.0-b18, =1.0.0-b18, =1.0.0-b18, =1.0.0-b18,...

org.jenkins-ci.plugins:gradle (2.12.0.1) potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1138.v8e727069a_025)

org.jenkins-ci.plugins:script-security MAVEN version 1138.v8e727069a025 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:gradle 2.12.0.1 Source cves: CVE-2024-52549...

io.jenkins.plugins:coverage-badges-extension (>=-rc6.886d29ff0f4d, <=47.v41e62ecf0928), jp.ikedam.jenkins.plugins:scoring-load-balancer (>=68.va_4591100d6a_b, <=97.v8e470ff53e15) +9 more potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1294.v99333c047434)

org.jenkins-ci.plugins:script-security MAVEN version 1294.v99333c047434 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:coverage-badges-extension =-rc6.886d29ff0f4d,...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +94 more potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1.13)

org.jenkins-ci.plugins:script-security MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - aendter.jenkins.plugins:filesystem-list-parameter-plugin 0.0.6 -...

de.wellnerbou.jenkins:git-changelog (>=3.0, <=3.31) potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1.46)

org.jenkins-ci.plugins:script-security MAVEN version 1.46 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - de.wellnerbou.jenkins:git-changelog =3.0, =3.31 Source cves: CVE-2024-52549 Source...

CVE-2024-52549 vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2024-52549

creationtimestamp| type| source ---|---|--- 2024-11-13 20:55:33+00:00| seen| https://infosec.exchange/users/cve/statuses/113477637439411514 2024-11-13 22:20:22+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113477970956610756 2024-11-13 23:05:33+00:00| seen|...

CVE-2024-52549

Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va3bb89f8a95b and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the...