RHEL 7 : Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins (RHSA-2019:0739)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0739 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cro...

org.jenkins-ci.plugins:global-slack-notifier (>=1.0, <=1.3) potentially affected by CVE-2019-1003043 via org.jenkins-ci.plugins:slack (2.2)

org.jenkins-ci.plugins:slack MAVEN version 2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:slack and may be impacted: - org.jenkins-ci.plugins:global-slack-notifier =1.0, =1.3 Source cves: CVE-2019-1003043 Source advisory:...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.6), appscanstandard-integration:ibm-security-appscanstandard-scanner (>=1.0, <=2.8) +1420 more potentially affected by CVE-2016-5007 via org.springframework:spring-core (2.5.6.sec03)

org.springframework:spring-core MAVEN version 2.5.6.sec03 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - aendter.jenkins.plugins:filesystem-list-parameter-plugin =0.0.1, =1.0, =1.0, =0.0.1, =0.1.1...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.6), appscanstandard-integration:ibm-security-appscanstandard-scanner (>=1.0, <=2.8) +1420 more potentially affected by CVE-2015-5211 via org.springframework:spring-core (2.5.6.sec03)

org.springframework:spring-core MAVEN version 2.5.6.sec03 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - aendter.jenkins.plugins:filesystem-list-parameter-plugin =0.0.1, =1.0, =1.0, =0.0.1, =0.1.1...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.6), appscanstandard-integration:ibm-security-appscanstandard-scanner (>=1.0.0, <=2.8) +1714 more potentially affected by CVE-2018-1999045 via org.jenkins-ci.main:jenkins-core (>=1.396, <=2.57)

org.jenkins-ci.main:jenkins-core MAVEN version =1.396, =0.0.1, =1.0.0, =1.0, =0.0.1, =0.1.1, =0.1.0, =1.0, =0.9, =1.3, =1.0.5.0, =1.0.5.0, =1.0.6.1 and more Source cves: CVE-2018-1999045 Source advisory: MEND:CVE-2018-1999045...

Unauthorized users are able to determine when a plugin was extracted from its JPI package

Files indicating when a plugin JPI file was last extracted into a subdirectory of plugins/ in the Jenkins home directory were accessible via HTTP by users with Overall/Read permission. This allowed unauthorized users to determine the likely install date of a given plugin. The affected files are n...

CSRF vulnerability and missing permission checks in GitHub Pull Request Builder Plugin allowed server-side request forgery, capturing credentials

GitHub Pull Request Builder Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...

com.mobileenerlytics.eagle.tester:eagle-tester (>=1.0.6, <=1.0.9), hudson.plugins.signal_killer:signal-killer (1.1) +10 more potentially affected by CVE-2017-1000353 via org.jenkins-ci.main:jenkins-core (>=2.50, <=2.56)

org.jenkins-ci.main:jenkins-core MAVEN version =2.50, =1.0.6, =4.6.0.23, =2.50, =2.50, =2.0, =1.0, =0.2, =3.0, =0.2.6, =1.0-alpha-2, =0.13, =0.14 Source cves: CVE-2017-1000353 Source advisory: MEND:CVE-2017-1000353...

com.piketec.jenkins.plugins:piketec-tpt (6.3), io.jenkins.plugins:aws-lambda-cloud (>=0.3, <=0.4) +13 more potentially affected by CVE-2015-5318 via org.jenkins-ci.main:jenkins-core (>=1.626, <=1.637)

org.jenkins-ci.main:jenkins-core MAVEN version =1.626, =0.3, =1.2, =1.1.2, =1.626, =1.626, =1.1.0, =0.1, =0.2, =0.1, =2.4, =1.626, =1.21, =1.0.3, =1.0, =2.0.27 Source cves: CVE-2015-5318 Source advisory: MEND:CVE-2015-5318...

com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=1.3.5, <=1.4.24), com.sonymobile.jenkins.plugins.lenientshutdown:lenientshutdown (>=1.1.0, <=1.1.1) +13 more potentially affected by CVE-2015-1812 via org.jenkins-ci.main:jenkins-core (>=1.600, <=1.605)

org.jenkins-ci.main:jenkins-core MAVEN version =1.600, =1.3.5, =1.1.0, =1.17, =1.600, =1.600, =1.0, =1.14, =1.20, =1.600, =1.0, =1.0, =1.3 Source cves: CVE-2015-1812 Source advisory: MEND:CVE-2015-1812...