title: Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update
description: google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization maven: Block repositories using http by default golang: go/parser: stack exhaustion in all Parse* functions snakeyaml: Denial of Service due to missing nested depth limitation for collections maven-shared-utils: Command injection via Commandline class apache-commons-text: variable interpolation RCE guava: insecure temporary directory creation springframework: Spring Expression DoS Vulnerability spring-security: Empty SecurityContext Is Not Properly Saved Upon Logout jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter() jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies Jenkins: Temporary file parameter created with insecure permissions Jenkins: Information disclosure through error stack traces related to agents Jenkins: Open redirect vulnerability in OpenShift Login Plugin jetty: Improper validation of HTTP/1 content-length jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin jenkins-plugins: cloudbees-folder: Information disclosure in Folders Plugin jenkins-plugins: config-file-provider: Improper masking of credentials in Config File Provider Plugin jenkins-plugins: blueocean: CSRF vulnerability in Blue Ocean Plugin allows capturing credentials jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE jenkins: cross-site WebSocket hijacking
cpes: cpe:/a:redhat:ocp_tools:4.12::el8