title: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
description: http2-server: Invalid HTTP/2 requests cause DoS springframework: BCrypt skips salt rounds for work factor of 31 jettison: parser crash by stackoverflow jettison: memory exhaustion via user-supplied XML or JSON data xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS jackson-databind: use of deeply nested arrays json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) jettison: Uncontrolled Recursion in JSONArray springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern log4j1-socketappender: DoS via hashmap logging Jenkins: XSS vulnerability in plugin manager Jenkins: Temporary plugin file created with insecure permissions Jenkins: Temporary file parameter created with insecure permissions Jenkins: Information disclosure through error stack traces related to agents jenkins-2-plugin: workflow-job: Stored XSS vulnerability in Pipeline: Job Plugin jenkins-2-plugin: pipeline-utility-steps: Arbitrary file write vulnerability on agents in Pipeline Utility Steps Plugin
cpes: cpe:/a:redhat:ocp_tools:4.11::el8