RHCOS 4 : OpenShift Container Platform 4.1 jenkins-2-plugins (RHSA-2019:1636)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1636 advisory. - jenkins-credentials-plugin: Certificate file read vulnerability in Credentials Plugin SECURITY-1322 CVE-2019-10320 -...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11), org.jenkins-ci.plugins:workflow-remote-loader (>=1.0, <=1.5) potentially affected by CVE-2022-43405 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.11)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregato...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11), org.jenkins-ci.plugins:workflow-remote-loader (>=1.0, <=1.5) potentially affected by CVE-2022-43406 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.11)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregato...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11), org.jenkins-ci.plugins:workflow-remote-loader (>=1.0, <=1.5) potentially affected by CVE-2019-10357 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.11)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregato...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11), org.jenkins-ci.plugins:workflow-remote-loader (>=1.0, <=1.5) potentially affected by CVE-2018-1000015 via org.jenkins-ci.plugins.workflow:workflow-durable-task-step (1.11)

org.jenkins-ci.plugins.workflow:workflow-durable-task-step MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-durable-task-step and may be impacted: -...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11), org.jenkins-ci.plugins:workflow-remote-loader (>=1.0, <=1.5) potentially affected by CVE-2022-29047 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.11)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregato...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11), org.jenkins-ci.plugins:workflow-remote-loader (>=1.0, <=1.5) potentially affected by CVE-2022-25174 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.11)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregato...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11), org.jenkins-ci.plugins:workflow-remote-loader (>=1.0, <=1.5) potentially affected by CVE-2022-25177 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.11)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregato...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11), org.jenkins-ci.plugins:workflow-remote-loader (>=1.0, <=1.5) potentially affected by CVE-2022-25178 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.11)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregato...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11), org.jenkins-ci.plugins:workflow-remote-loader (>=1.0, <=1.5) potentially affected by CVE-2022-25181 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.11)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregato...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11), org.jenkins-ci.plugins:workflow-remote-loader (>=1.0, <=1.5) potentially affected by CVE-2022-25182 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.11)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregato...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11), org.jenkins-ci.plugins:workflow-remote-loader (>=1.0, <=1.5) potentially affected by CVE-2022-25183 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.11)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregato...

jenkins-plugin-workflow-remote-loader: Unsafe Script Security whitelist entry in Pipeline Remote Loader Plugin (SECURITY-921)

A flaw was found in the Jenkins Workflow Remote Loader plugin. An unsafe whitelist entry was made that allowed invoking arbitrary methods and bypassing sandbox protection. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

jenkins-plugin-workflow-remote-loader: Unsafe Script Security whitelist entry in Pipeline Remote Loader Plugin (SECURITY-921)

A flaw was found in the Jenkins Workflow Remote Loader plugin. An unsafe whitelist entry was made that allowed invoking arbitrary methods and bypassing sandbox protection. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Unsafe entry in Script Security list of approved signatures in workflow-remote-loader

workflow-remote-loader provides a custom list of pre-approved signatures for Script Security. Those entries apply to all scripts with sandbox protection, such as Pipeline. One entry provided here was unsafe, as it allowed invoking arbitrary methods, bypassing sandbox protection. The unsafe...