jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin

A cross-site request forgery CSRF vulnerability was found in a Jenkins plugin. This issue may allow an unauthenticated attacker to access Jenkins builds, bypassing CSRF protections. This could compromise the integrity, availability, and confidentiality of Jenkins...

Cross-site request forgery in Jenkins Gerrit Trigger Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit...

GHSA-95JQ-24CR-PGRQ Cross-site request forgery in Jenkins Gerrit Trigger Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit...

CVE-2023-24423

A cross-site request forgery CSRF vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit...

November 8, 2022—KB5019959 (OS Builds 19042.2251, 19043.2251, 19044.2251, and 19045.2251) - EXPIRED

None None...

java-1.8.0-openjdk security and bug fix update

1.8.0.362.b09-2.0.1 - Replace upstream references Orabug: 34340145 1:1.8.0.362.b09-2 - Update cacerts patch to fix OPENJDK-1433 SecurityManager issue - Update to shenandoah-jdk8u352-b09 GA - Update release notes for shenandoah-8u352-b09. - Resolves: rhbz2163594 1:1.8.0.362.b08-2 - Update to...

PT-2023-12647 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to Android-12L Description: The issue concerns the logging of sensitive information, such as personally identifiable information PII or hardware identifiers, in Android builds. Specifically, the...

CVE-2023-24423

A cross-site request forgery CSRF vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit...

CVE-2023-24423

A cross-site request forgery CSRF vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit...

Moderate: Red Hat Security Advisory: OpenJDK 11.0.18 Security Update for Portable Linux Builds

The Red Hat Build of OpenJDK 11 java-11-openjdk is now available for portable Linux. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

java-11-openjdk security and bug fix update

11.0.18.0.10-2.0.1 - Replace upstream references Orabug: 34340155 1:11.0.18.0.10-2 - Update to jdk-11.0.18+10 GA - Update release notes to 11.0.18+10 - Switch to GA mode for release - This tarball is embargoed until 2023-01-17 @ 1pm PT. - Related: rhbz2157798 1:11.0.18.0.9-0.2.ea - Update to...

java-17-openjdk security and bug fix update

1:17.0.6.0.10-3 - Add missing release note for JDK-8295687 - Resolves: rhbz2160111 1:17.0.6.0.10-3 - Update FIPS support to bring in latest changes - OJ1357: Fix issue on FIPS with a SecurityManager in place - Related: rhbz2147473 1:17.0.6.0.10-3 - Fix flatpak builds by disabling TestTranslations...

GSD-2023-1000070 drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame

drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.12 by commit...

PT-2023-33244 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.82 Description: The issue is related to a problem with Clang builds in the drm/amdgpu component, which may lead to a blown stack-frame. The actual impact and potential for attack have not been proven yet...

PT-2023-33315 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.158 Description: The issue is related to a problem with Clang builds in the drm/amdgpu component, which may lead to a blown stack-frame. The actual impact and potential for attack have not been proven yet...

PT-2023-33147 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.12 Description: The issue is related to a problem with Clang builds in the drm/amdgpu component, which may lead to a blown stack-frame. The actual impact and potential for attack have not been proven yet...

jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git

A flaw was found in the Git Jenkins plugin. The affected versions of the Git Jenkins Plugin allow attackers to trigger the builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit...

EulerOS Virtualization 2.10.1 : yajl (EulerOS-SA-2023-1160)

According to the versions of the yajl package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integ...

CVE-2022-23506 Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposur...

SUSE-SU-2023:0011-1 Security update for saphanabootstrap-formula

This update for saphanabootstrap-formula fixes the following issues: - Version bump 0.13.1 revert changes to spec file to re-enable SLES RPM builds CVE-2022-45153: Fixed privilege escalation for arbitrary users in hana/hacluster.sls bsc1205990 - Version bump 0.13.0 pass sid to sudoers in a SLES12...