title: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
description: google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization kubernetes-client: Insecure deserialization in unmarshalYaml method jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode springframework: Authorization Bypass in RegexRequestMatcher com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks apache-commons-text: variable interpolation RCE jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin FileUpload: FileUpload DoS with excessive parts jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin Jenkins: Denial of Service attack Jenkins: Denial of Service attack Jenkins: Workspace temporary directories accessible through directory browser Jenkins: Information disclosure through error stack traces related to agents
cpes: cpe:/a:redhat:ocp_tools:4.13::el8