title: Red Hat Security Advisory: OpenShift Developer Tools and Services for OCP 4.12 security update
description: Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS jackson-databind: use of deeply nested arrays jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin jenkins-plugin/mercurial: Webhook endpoint discloses job names to unauthorized users in Mercurial Plugin mina-sshd: Java unsafe deserialization vulnerability
cpes: cpe:/a:redhat:ocp_tools:4.12::el8